Salesforce is retiring the OAuth user-agent flow and the OAuth hybrid user-agent flow. For better security, update your integrations to use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension.
Where: This change applies to Lighting Experience and Salesforce Classic in all editions.
When: Salesforce enforces this update on February 20, 2027.
Why: This update improves security and better protects your Salesforce data. The user-agent and hybrid user-agent flows are insecure because they directly expose access tokens to the browser. By migrating to more secure flows, you can keep access tokens safe.
How: Integrations that use these insecure flows will no longer work when the retirement takes effect. As an app developer, update your integrations to use more secure flows. For apps that you didn’t develop, such as apps installed from managed packages, contact the app developer.
To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For OAuth User-Agent and Hybrid User-Agent Flows Retirement, follow the testing and activation steps.
See Also
- Salesforce Help: OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration
- Salesforce Help: OAuth 2.0 Hybrid User-Agent Token Flow for Web Session Management
- Salesforce Help: Block Authorization Flows to Improve Security
- Salesforce Help: OAuth 2.0 Web Server Flow for Web App Integration
- Salesforce Help: OAuth 2.0 Hybrid Web Server Flow
- Salesforce Help: Proof Key for Code Exchange (PKCE) Extension