---
schema_version: "1"
id: 1a92ec72bdab307946e6d5649616a781125a89ea3ee3d46de75f2f4f3ed0c4de
title: Allow OAuth Refresh Tokens Only in Certain IP Ranges
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_identity_refresh_token_ip_allowlist.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_identity_refresh_token_ip_allowlist.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 21199e932c5d01f5f11e9da32c4c38c0652993aa51c7a345aa765ba1ec69b816
description: Secure your external client apps and connected apps by restricting OAuth refresh tokens to known network locations. This security enhancement ensures that refresh tokens are rejected if they originate from an IP address outside of your defined ranges. Your developers can now prevent unauthorized token use even if a valid token is compromised.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Allow OAuth Refresh Tokens Only in Certain IP Ranges

Secure your external client apps and connected apps by restricting OAuth refresh tokens to known network locations. This security enhancement ensures that refresh tokens are rejected if they originate from an IP address outside of your defined ranges. Your developers can now prevent unauthorized token use even if a valid token is compromised.

**Where:** This change applies to Lightning Experience and Salesforce Classic in all editions.

**When:** This feature is available in Winter '26 on a rolling basis.

**How:** To implement this restriction, define allowed IP ranges and turn on Enforce Refresh Token IP Allowlist. The system then automatically validates the request IP against these stored ranges during the token exchange process.

#### See Also

- [_Salesforce Help_: Set IP Allowlist Ranges for Refresh Tokens](https://help.salesforce.com/s/articleView?id=set_ip_allowlist_for_refresh_tokens.htm&language=en_US)