---
schema_version: "1"
id: b66e24221aea3fa72e9b9e86c905131ba3ab0f47d03f238e73a9228040e1ace3
title: Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_unpw_flow_retirement.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_unpw_flow_retirement.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c476f685ed10f369a17cbeab9b98504b74bc2ca4605c7207be4ee24c8b956941
description: When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead.
products:
  - Cross Cloud
release: "262"
---
# Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)

When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead.

**Where:** This change applies to Lighting Experience and Salesforce Classic in all editions. If you don't see this release update, you already have the username-password flow blocked, and this change doesn't affect you.

**When:** Salesforce enforces this update on February 20, 2027. This update was first announced in Spring ’26. It was originally scheduled to be enforced with the Winter ’27 major release, but we changed the enforcement date.

As part of this change, Salesforce prevents you from using the OAuth username-password flow in orgs that are created in Summer ’26 and later. On the OAuth and OpenID Connect Settings page, the option to allow OAuth username-password flows is disabled and grayed out.

**Why:** This update improves security and better protects your Salesforce data. The username-password flow directly passes the user’s credentials in HTTP requests, which presents security risks.

**How:** All connected app integrations that use the username-password flow will no longer work. As an app developer, update your integrations to use a more secure flow. For end user login and authorization, use the OAuth 2.0 web-server flow with the Proof Key for Code Exchange (PKCE) extension. For server-to-server integrations, use the OAuth 2.0 client credentials flow. For apps that you didn't develop, contact the app developer.

To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select **Release Updates**. For Retirement of OAuth 2.0 Username-Password Flow for Connected Apps, follow the testing and activation steps.

#### See Also

- [_Salesforce Help_: OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&language=en_US)
- [_Salesforce Help_: Block Authorization Flows to Improve Security](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US)
- [_Salesforce Help_: Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US)