---
schema_version: "1"
id: bb15ab8d399d9cebf2ab908b0b88bc56befe27149c424d54c67ddcc381384897
title: OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_user_agent_retirement.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_user_agent_retirement.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7295d55515a13a0494f64f7f04e54c467db151849877e9942b862ffbfb8e1371
description: Salesforce is retiring the OAuth user-agent flow and the OAuth hybrid user-agent flow. For better security, update your integrations to use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension.
products:
  - Cross Cloud
release: "262"
---
# OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)

Salesforce is retiring the OAuth user-agent flow and the OAuth hybrid user-agent flow. For better security, update your integrations to use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension.

**Where:** This change applies to Lighting Experience and Salesforce Classic in all editions.

**When:** Salesforce enforces this update on February 20, 2027.

**Why:** This update improves security and better protects your Salesforce data. The user-agent and hybrid user-agent flows are insecure because they directly expose access tokens to the browser. By migrating to more secure flows, you can keep access tokens safe.

**How:** Integrations that use these insecure flows will no longer work when the retirement takes effect. As an app developer, update your integrations to use more secure flows. For apps that you didn’t develop, such as apps installed from managed packages, contact the app developer.

To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select **Release Updates**. For OAuth User-Agent and Hybrid User-Agent Flows Retirement, follow the testing and activation steps.

#### See Also

- [_Salesforce Help_: OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 Hybrid User-Agent Token Flow for Web Session Management](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_token_flow.htm&language=en_US)
- [_Salesforce Help_: Block Authorization Flows to Improve Security](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 Hybrid Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_web_server_flow.htm&language=en_US)
- [_Salesforce Help_: Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&language=en_US)