---
schema_version: "1"
id: b401e8484c91e999a14448d6b809acf703952095ed3cd6bfa3b1b494517266b8
title: Secure Your Connected App and External Client App Solutions
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_appexchange_connectedapps_eca_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_appexchange_connectedapps_eca_security.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7953ca0f5fd500ad97d71c6205c63718a6e459d4d56a0b2593c71cc1316a63e4
description: All AgentExchange Partners must follow new security requirements for Connected App (CA) and External Client App (ECA) solutions to ensure the highest level of trust and security for Customer Data. These requirements apply to any Connected App or External Client App that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs. These updates include mandatory Proof Key for Code Exchange (PKCE) and Refresh Token Rotation (RTR) enablement to prevent authorization code interception and token theft. Implementing these standards ensures these CAs or ECAs meet the latest Salesforce security protocols and safeguard Customer Data. Failure to comply may result in the Partner Application’s AgentExchange de-listing and/or Salesforce’s temporary or permanent suspension of the Partner Application’s interoperation with Salesforce’s services.
products:
  - Cross Cloud
release: "262"
---
# Secure Your Connected App and External Client App Solutions

All AgentExchange Partners must follow new security requirements for Connected App (CA) and External Client App (ECA) solutions to ensure the highest level of trust and security for Customer Data. These requirements apply to any Connected App or External Client App that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs. These updates include mandatory Proof Key for Code Exchange (PKCE) and Refresh Token Rotation (RTR) enablement to prevent authorization code interception and token theft. Implementing these standards ensures these CAs or ECAs meet the latest Salesforce security protocols and safeguard Customer Data. Failure to comply may result in the Partner Application’s AgentExchange de-listing and/or Salesforce’s temporary or permanent suspension of the Partner Application’s interoperation with Salesforce’s services.

**Where:** Any Connected App or External Client App that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs.

**When:** Mandatory security requirements must be implemented for any CAs/ECAs by May 11, 2026.

**Why:** Detailed security configurations like RTR and PKCE provide critical defense layers against threat actors.

**How:** For any Partner Applications with CAs or ECAs that are included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs, update your CA or ECA definitions to enable PKCE and Refresh Token Rotation within your app configurations and implement relevant changes in the client code.

#### See Also

- [Connected App and External Client App Security Requirements for AppExchange](https://help.salesforce.com/s/articleView?id=005232552&type=1&language=en_US)