---
schema_version: "1"
id: 30bfe821c0fa3e4ed2c361487508378a75706b57ddf328fead782cb13b73983c
title: OAuth Security Controls Are Enforced for New External Client Apps and Connected Apps
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_oauth_controls_new_apps.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_oauth_controls_new_apps.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b6d08cdfbcca48785cf96046880fe857bbde688546069eb8b3bf8ca2e5f56166
description: "Starting in July 2026, Salesforce enforces OAuth security controls for new external client apps and connected apps. The Proof Key for Code Exchange (PKCE) extension is required for apps that use the authorization code grant type. For apps that use the refresh token flow, Salesforce requires two controls: refresh token rotation and a 30-day limit to the time-to-live (TTL) for idle refresh tokens."
products:
  - Cross Cloud
release: "262"
---
# OAuth Security Controls Are Enforced for New External Client Apps and Connected Apps

Starting in July 2026, Salesforce enforces OAuth security controls for new external client apps and connected apps. The Proof Key for Code Exchange (PKCE) extension is required for apps that use the authorization code grant type. For apps that use the refresh token flow, Salesforce requires two controls: refresh token rotation and a 30-day limit to the time-to-live (TTL) for idle refresh tokens.

**Where:** This change applies to Lightning Experience and Salesforce Classic in all editions.

**When:** This change applies to external client apps and connected apps that are created in July 2026 and later. With the exception of [Partner Applications](https://help.salesforce.com/s/articleView?id=005387798&type=1&language=en_US), these controls aren't currently enforced for apps that were created before July 2026. However, to protect your data, we strongly recommend that you implement these controls across all of your apps.

When Salesforce first released this change in July 2026, the setting to require PKCE was auto-enabled and locked only for new apps where the callback URL was set to a localhost or custom scheme URL. Starting in August 2026, this setting is now auto-enabled for all new apps, regardless of the callback URL.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/images/icon_note.png)

Note By default, Salesforce blocks you from creating new connected apps. These security requirements are relevant for connected apps only if Support has allowed you to continue creating them. See [Salesforce Platform: New Connected Apps Can No Longer Be Created in Spring '26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US).

For connected apps that were created before July 2026, if you migrate to an external client app, Salesforce doesn't enforce these controls for the migrated app. Also, if a subscriber installs an app that was created before July 2026, Salesforce doesn't enforce these controls for the installed instance of the app. The enforcement is based on when the app was created in the source org.

**Why:** These controls protect your Salesforce data from unauthorized access. PKCE prevents interception attacks, where attackers steal an authorization code and exchange it for an access token. Refresh token rotation and the idle TTL limit make it harder for attackers to use compromised refresh tokens to get new access tokens.

**How:** Salesforce enforces these controls by auto-enabling and locking OAuth settings for new external client apps and connected apps. This includes apps that you create via the UI, metadata, or dynamic client registration. Use this table to understand the requirements and enforcement behavior for each flow.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:25%">
        <col style="width:25%">
        <col style="width:25%">
        <col style="width:25%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d107880e91">Security Control</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d107880e94">Applicable OAuth Flows</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d107880e97">UI Behavior</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d107880e100">Client-Side Code Requirements</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Security Control" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e91 "><a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&amp;language=en_US" target="_blank"><dfn>PKCE</dfn></a>: ensures that the client who
            initiated the flow is the same client who completes the flow.</td>

          <td data-label="Applicable OAuth Flows" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e94 ">
            <p>PKCE is enforced for these OAuth flows.</p>
            <ul>
              <li><a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&amp;language=en_US" target="_blank">Web-server</a></li>

              <li><a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_web_server_flow.htm&amp;language=en_US" target="_blank">Hybrid web-server</a></li>

              <li>All variations of the headless Authorization Code and Credentials Flow,
                including headless login, registration, passwordless login, and guest user flows.
                See <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_identity_pointer.htm&amp;language=en_US&amp;type=5" target="_blank">Headless Identity Flows</a>.</li>

            </ul>
          </td>

          <td data-label="UI Behavior" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e97 ">When you save a new app, Salesforce auto-enables the <strong class="uicontrol">Require Proof Key
              for Code Exchange (PKCE) Extension for Supported Authorization Flows</strong>
            setting, locks it, and grays it out. </td>

          <td data-label="Client-Side Code Requirements" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e100 ">
            <p>The client must implement PKCE for applicable OAuth flows:</p>
            <ul>
              <li>Generate <code>code_challenge</code> and <code>code_verifier</code>
                parameters.</li>

              <li>Requests to the <samp class="filepath">/services/oauth2/authorize</samp> endpoint must
                include the <code>code_challenge</code>.</li>

              <li>Requests to the <samp class="filepath">/services/oauth2/token</samp> endpoint must
                include the <code>code_verifier</code>.</li>

            </ul>
          </td>

        </tr>
        <tr class="">
          <td data-label="Security Control" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e91 "><a href="https://help.salesforce.com/s/articleView?id=005316711&amp;language=en_US&amp;type=1" target="_blank"><dfn>Refresh token rotation</dfn></a>: each time
            a refresh token is used, Salesforce invalidates it and issues a new one.</td>

          <td data-label="Applicable OAuth Flows" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e94 ">
            <ul>
              <li><a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_refresh_token_flow.htm&amp;language=en_US" target="_blank">Refresh token flow</a></li>

              <li><a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow.htm&amp;language=en_US" target="_blank">Hybrid refresh token flow</a></li>

            </ul>
          </td>

          <td data-label="UI Behavior" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e97 ">When you create an app, the <strong class="uicontrol">Enable Refresh Token Rotation</strong>
            setting is auto-enabled, locked, and grayed out.</td>

          <td data-label="Client-Side Code Requirements" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e100 ">The client-side code must be able to handle the new refresh token and store it
            securely.</td>

        </tr>
        <tr class="">
          <td data-label="Security Control" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e91 "><a href="https://help.salesforce.com/s/articleView?id=xcloud.eca_limit_idle_refresh_token_ttl.htm&amp;language=en_US" target="_blank"><dfn>Idle refresh token TTL</dfn></a>: limits
            the validity period for unused refresh tokens to 30 days. Each time a token is used
            within the 30 day-period, the idle TTL resets. </td>

          <td data-label="Applicable OAuth Flows" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e94 ">
            <ul>
              <li><a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_refresh_token_flow.htm&amp;language=en_US" target="_blank">Refresh token flow</a></li>

              <li><a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow.htm&amp;language=en_US" target="_blank">Hybrid refresh token flow</a></li>

            </ul>
          </td>

          <td data-label="UI Behavior" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e97 ">When you create an app, the <strong class="uicontrol">Limit Idle Refresh Token Time-to-Live
              (TTL) to 30 Days</strong> setting is auto-enabled, locked, and grayed
            out.</td>

          <td data-label="Client-Side Code Requirements" class="slds-cell-wrap" style="vertical-align:top;" headers="d107880e100 ">This control doesn't require any changes on the client side. Optionally, to avoid
            re-authorizing, you can update your code to initiate a refresh token flow before the
            30-day limit and receive a new refresh token.</td>

        </tr>
      </tbody>
    </table>

#### See Also

- [_Salesforce Help_: Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&language=en_US)
- [_Knowledge Article_: Force one-time-use Refresh Tokens - (RTR) Refresh Token Rotation](https://help.salesforce.com/s/articleView?id=005316711&type=1&language=en_US)
- [_Salesforce Help_: Limit the Idle Refresh Token TTL in External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.eca_limit_idle_refresh_token_ttl.htm&language=en_US)
- [_Salesforce Help_: Limit the Idle Refresh Token TTL in Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_limit_idle_ttl.htm&language=en_US)