---
schema_version: "1"
id: 4ad0238f37f1ea772a037dc89ad6721b8ad1e107e56180df163b696649663cfc
title: Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_username_password_flow_retirement.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_username_password_flow_retirement.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: cd029f12170f26d61019552ea48dc62e5e90d5805a202fa424c8df2925492bb1
description: In Winter ’27, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)

In Winter ’27, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead.

**Where:** This change applies to Lighting Experience and Salesforce Classic in all editions. If you don't see this release update, you already have the username-password flow blocked, and this change doesn't affect you.

**When:** Salesforce enforces this update in Winter ’27. To get the major release upgrade date for your instance, go to [Trust Status](https://status.salesforce.com/), search for your instance, and click the maintenance tab.

This release update is currently English-only. Translations are scheduled to be available in late March 2026.

**Why:** This update improves security and better protects your Salesforce data. The username-password flow directly passes the user’s credentials in HTTP requests, which presents security risks.

**How:** All connected app integrations that use the username-password flow will no longer work. As an app developer, update your integrations to use a more secure flow. For end user login and authorization, use the OAuth 2.0 web-server flow with the Proof Key for Code Exchange (PKCE) extension. For server-to-server integrations, use the OAuth 2.0 client credentials flow. For apps that you didn't develop, contact the app developer.

To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select **Release Updates**. For Retirement of OAuth 2.0 Username-Password Flow for Connected Apps, follow the testing and activation steps.

#### See Also

- [_Salesforce Help_: OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&language=en_US)
- [_Salesforce Help_: Block Authorization Flows to Improve Security](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US)
- [_Salesforce Help_: Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US)