Replace your connected apps with external client apps.
- Migrate All Connected Apps to External Client Apps (Release Update)
Keep your integrations supported by migrating to external client apps. In Summer '27, Salesforce is ending support for connected apps. Connected apps will keep working, but Salesforce will no longer fix bugs or provide support for the integrations and authorization flows that use them. This update is available starting in Winter ’27 and is enforced for production instances in Summer ’27. - Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update)
To secure the OAuth 2.0 device flow, Salesforce is restricting this flow to local external client apps with a localhost callback URL. To prepare for this change, review your usage of the device flow and update your connected apps and external client apps to meet the new criteria. For connected apps, you must migrate to external client apps to continue using the device flow. This update is available in late Summer ’26 and is enforced on November 30, 2026. - Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)
When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead. This update was first available in Spring ’26 and was scheduled to be enforced in Winter ’27, but we postponed the enforcement date to February 20, 2027. - OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)
Salesforce is retiring the OAuth user-agent flow and the OAuth hybrid user-agent flow. For better security, update your integrations to use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension. This update was first available in late Summer ’26 and is enforced on February 20, 2027. - OAuth User-Agent and Hybrid User-Agent Flows Are Blocked in New Orgs
To support the retirement of the OAuth user-agent and hybrid user-agent flows, Salesforce blocks these flows in new orgs. If you try to use the user-agent flow in a new Winter ’27 org, it fails with aninvalid_granterror. For better security, use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension instead. - Refresh Token Idle TTL Is Limited to 30 Days
To protect your data, Salesforce limits how long an idle OAuth refresh token can stay valid. With the enforced idle time-to-live (TTL) setting, refresh tokens expire if they haven’t been used for 30 days. For integrations that don’t use refresh tokens, this control caps the access token lifetime at 30 days from the last login date. At the time of enforcement, Salesforce immediately expires refresh tokens that have been idle for more than 30 days, along with long-running access tokens where the last login date was more than 30 days ago. As a result, users can be logged out and background integrations can be required to request new access tokens. Before Salesforce enforces this change, review how your apps behave when OAuth tokens expire. - Protect Your Data with the OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) Extension
Secure your client apps with the Demonstrating Proof-of-Possession (DPoP) extension. DPoP cryptographically binds OAuth access and refresh tokens to your client. To use a token, clients must prove that they own the private key. Even if a threat actor steals an OAuth token, they can’t use it to access your data. - Monitor App Security Controls on the Insights Page
Review the security controls of the external client apps and connected apps in your org on the Insights page. Verify that your apps are compliant, and manage their security controls. Monitor the status of both enabled and disabled apps whether they are local or developed outside your org.