---
schema_version: "1"
id: 7ddb7ed00efc43fe215163694cb6aa32765e2d13733037102e2a346763039430
title: Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_security_oauth_device.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_oauth_device.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1de23336db913cd4bbc36d4a44da4d4529f12c5691f420f056c3aa1e0fb30d1e
description: To secure the OAuth 2.0 device flow, Salesforce is restricting this flow to local external client apps with a localhost callback URL. To prepare for this change, review your usage of the device flow and update your connected apps and external client apps to meet the new criteria. For connected apps, you must migrate to external client apps to continue using the device flow. This update is available in late Summer ’26 and is enforced on November 30, 2026.
products:
  - Cross Cloud
release: "264"
---
# Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update)

To secure the OAuth 2.0 device flow, Salesforce is restricting this flow to local external client apps with a localhost callback URL. To prepare for this change, review your usage of the device flow and update your connected apps and external client apps to meet the new criteria. For connected apps, you must migrate to external client apps to continue using the device flow. This update is available in late Summer ’26 and is enforced on November 30, 2026.

**Where:** This change applies to connected apps and external client apps in all editions.

**When:** Salesforce enforces this update by blocking the device flow for non-compliant apps on November 30, 2026.

**Why:** This security update protects your Salesforce data. By restricting how and when the device flow can be used, Salesforce can prevent illegitimate use of the device flow. The device flow is intended only for apps that run on devices with limited input or display capabilities, such as Smart TVs, appliances, and other Internet of Things (IoT) devices.

**How:** When this release update is enforced, the device flow will only work for local external client apps with a localhost callback URL. The device flow will no longer work for connected apps, packaged external client apps, or local external client apps that don't have a localhost callback URL. To continue using the device flow without disruption, update your apps to meet these requirements.

To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select **Release Updates**. For Restrict the OAuth 2.0 Device Flow to Local External Client Apps, follow the testing and activation steps.

#### See Also

- [Release Updates](https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&release=264.0.0&type=5 "Salesforce periodically provides release updates that improve the performance, logic, security, and usability of our products. The Release Updates page provides a list of updates that can be necessary for your organization to enable. Some release updates affect existing customizations.")