To secure the OAuth 2.0 device flow, Salesforce is restricting this flow to local external client apps with a localhost callback URL. To prepare for this change, review your usage of the device flow and update your connected apps and external client apps to meet the new criteria. For connected apps, you must migrate to external client apps to continue using the device flow. This update is available in late Summer ’26 and is enforced on November 30, 2026.
Where: This change applies to connected apps and external client apps in all editions.
When: Salesforce enforces this update by blocking the device flow for non-compliant apps on November 30, 2026.
Why: This security update protects your Salesforce data. By restricting how and when the device flow can be used, Salesforce can prevent illegitimate use of the device flow. The device flow is intended only for apps that run on devices with limited input or display capabilities, such as Smart TVs, appliances, and other Internet of Things (IoT) devices.
How: When this release update is enforced, the device flow will only work for local external client apps with a localhost callback URL. The device flow will no longer work for connected apps, packaged external client apps, or local external client apps that don't have a localhost callback URL. To continue using the device flow without disruption, update your apps to meet these requirements.
To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For Restrict the OAuth 2.0 Device Flow to Local External Client Apps, follow the testing and activation steps.