To improve security, users with the API Only User permission can no longer bridge into UI sessions by using the frontdoor URL generated by the /services/oauth2/singleaccess endpoint, also known as UI Bridge API. This change can break integrations that unintentionally grant UI access to API-only users.
Where: This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in all editions.
How: If you call the /services/oauth2/singleaccess endpoint with
an access token that was issued to an API-only user, the call fails with a
Bad_OAuth_Token error.
To allow these users to bridge into UI sessions via frontdoor URLs, remove the API Only User permission.