To defend against stolen-credential and token-replay attacks, Salesforce is enabling Refresh Token Rotation (RTR). Because refresh tokens keep users signed in without re-entering passwords, updating your app for RTR support ensures their access remains secure and uninterrupted.
Note Your branded app was built on a version that predates RTR support. When Salesforce enables
RTR for your app, users still on the older build will be signed out and unable to log back in
until you publish an updated version. Because you control which version of your branded app is
live in the app stores, this update is yours to make.
Where: This change applies to LWR and Aura Experience Cloud sites accessed through Mobile Publisher apps in Enterprise, Performance, Unlimited, and Developer editions.
When: This change is available starting October 21, 2026.
How: Update your app to the latest version after October 21, 2026, so your users can remain logged in to your app.