Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)

In Winter ’27, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead.

Where: This change applies to Lighting Experience and Salesforce Classic in all editions. If you don't see this release update, you already have the username-password flow blocked, and this change doesn't affect you.

When: Salesforce enforces this update in Winter ’27. To get the major release upgrade date for your instance, go to Trust Status, search for your instance, and click the maintenance tab.

This release update is currently English-only. Translations are scheduled to be available in late March 2026.

Why: This update improves security and better protects your Salesforce data. The username-password flow directly passes the user’s credentials in HTTP requests, which presents security risks.

How: All connected app integrations that use the username-password flow will no longer work. As an app developer, update your integrations to use a more secure flow. For end user login and authorization, use the OAuth 2.0 web-server flow with the Proof Key for Code Exchange (PKCE) extension. For server-to-server integrations, use the OAuth 2.0 client credentials flow. For apps that you didn't develop, contact the app developer.

To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For Retirement of OAuth 2.0 Username-Password Flow for Connected Apps, follow the testing and activation steps.