Secure your external client apps and connected apps by restricting OAuth refresh tokens to known network locations. This security enhancement ensures that refresh tokens are rejected if they originate from an IP address outside of your defined ranges. Your developers can now prevent unauthorized token use even if a valid token is compromised.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
When: This feature is available in Winter '26 on a rolling basis.
How: To implement this restriction, define allowed IP ranges and turn on Enforce Refresh Token IP Allowlist. The system then automatically validates the request IP against these stored ranges during the token exchange process.