To secure the OAuth 2.0 device flow, Salesforce is restricting this flow to local external client apps with a localhost callback URL. To prepare for this change, review your usage of the device flow and update your connected apps and external client apps to meet the new criteria. For connected apps, you must migrate to external client apps to continue using the device flow.
Where: This change applies to connected apps and external client apps in all editions.
When: Salesforce enforces this update by blocking the device flow for non-compliant apps on November 30, 2026. A non-compliant app is any app that has the device flow enabled but doesn't meet these criteria:
- External client app
- Distribution state set to local
- Localhost callback URL
- No other OAuth flows are enabled in the app settings
Starting in August 2026, these changes take effect:
If the device flow is enabled for any local external client app, you see this banner: "The OAuth device flow is enabled. Only use this flow with devices that run on limited input or display capabilities, such as Smart TVs, appliances, and other Internet of Things (IoT) devices." This banner appears even if an app is compliant with the new requirements.
If an app with the device flow enabled is non-compliant, there's an additional banner and some new behavior:
- You see this warning banner: "This app has the OAuth device flow enabled, but doesn’t meet new security requirements. To continue using the device flow, switch to a local external client app with a localhost callback URL and don’t use the app with any other OAuth flows. Learn more."
- You can't save changes to the app when the device flow is enable. You get this error: "The OAuth device flow is supported only for local external client apps with a localhost callback URL. Disable the device flow or switch to a local external client app that you don’t use with any other OAuth flows."
- If you disable the device flow on a connected app or on a packaged external client app, you see a warning popup for this new behavior: "After you save this change, you can’t undo it. To use the device flow again, you need a local external client app with a localhost callback URL."
If the device flow is disabled for a non-compliant app:
- (Connected apps only) The option to enable the device flow is now locked and hidden.
- (Packaged external client apps only) The option to enable the device flow is grayed out. To enable the device flow, update the app's distribution state to local.
- (Local external client apps with a non-localhost callback URL only) If you try to enable the device flow, you see a warning popup for this new behavior: "Enabling the device flow automatically sets the callback URL to https://localhost, removes all other callback URL values, and disables all other OAuth flows. These changes can affect your integrations."
Why: This security update protects your Salesforce data. By restricting how and when the device flow can be used, Salesforce can prevent illegitimate use of the device flow. The device flow is intended only for apps that run on devices with limited input or display capabilities, such as Smart TVs, appliances, and other Internet of Things (IoT) devices.
How: When this release update is enforced, the device flow will only work for local external client apps with a localhost callback URL. The device flow will no longer work for connected apps, packaged external client apps, or local external client apps that don't have a localhost callback URL. To continue using the device flow without disruption, update your apps to meet these requirements.
To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For Restrict the OAuth 2.0 Device Flow to Local External Client Apps, follow the testing and activation steps.