When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead. This update was first available in Spring ’26 and was scheduled to be enforced in Winter ’27, but we postponed the enforcement date to February 20, 2027.
Where: This change applies to Lighting Experience and Salesforce Classic in all editions. If you don't see this release update, you already have the username-password flow blocked, and this change doesn't affect you.
When: Salesforce enforces this update on February 20, 2027.
As part of this change, Salesforce prevents you from using the OAuth username-password flow in orgs that are created in Summer ’26 and later. On the OAuth and OpenID Connect Settings page, the option to allow OAuth username-password flows is disabled and grayed out.
Why: This update improves security and better protects your Salesforce data. The username-password flow directly passes the user’s credentials in HTTP requests, which presents security risks.
How: All connected app integrations that use the username-password flow will no longer work. As an app developer, update your integrations to use a more secure flow. For end user login and authorization, use the OAuth 2.0 web-server flow with the Proof Key for Code Exchange (PKCE) extension. For server-to-server integrations, use the OAuth 2.0 client credentials flow. For apps that you didn't develop, contact the app developer.
To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For Retirement of OAuth 2.0 Username-Password Flow for Connected Apps, follow the testing and activation steps.