Refresh Token Rotation (RTR) protects your Salesforce data by issuing a new refresh token every time the Field Service mobile app authenticates. This feature closes a gap where a threat actor tries to use a stolen token to access your org and your data. With RTR, a stolen token stops working almost immediately. This works in tandem with the previously announced refresh token idle security feature.
Where: This change applies to the Field Service mobile app for Android and iOS.
How: We include RTR automatically in the Field Service mobile app v264.1 and later—no setup is required. Your team must update their devices from the Apple App Store or Google Play Store to v264.1 or later before January 18, 2027. After this date, devices running older versions experience periodic forced logouts, and mobile workers lose any unsynced work on the device when logout occurs.