---
schema_version: "1"
id: 771d61c9974a74a873078ce3a63ea037977667bc0c5e827672b49b791d3767ef
title: Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_security_oauth_unpw.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_oauth_unpw.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 319e697b385a8dac756ab52321ca9da1b6cb4205bfb49e339920d865ffc7f94b
description: When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead. This update was first available in Spring ’26 and was scheduled to be enforced in Winter ’27, but we postponed the enforcement date to February 20, 2027.
products:
  - Cross Cloud
release: "264"
---
# Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)

When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead. This update was first available in Spring ’26 and was scheduled to be enforced in Winter ’27, but we postponed the enforcement date to February 20, 2027.

**Where:** This change applies to Lighting Experience and Salesforce Classic in all editions. If you don't see this release update, you already have the username-password flow blocked, and this change doesn't affect you.

**When:** Salesforce enforces this update on February 20, 2027.

As part of this change, Salesforce prevents you from using the OAuth username-password flow in orgs that are created in Summer ’26 and later. On the OAuth and OpenID Connect Settings page, the option to allow OAuth username-password flows is disabled and grayed out.

**Why:** This update improves security and better protects your Salesforce data. The username-password flow directly passes the user’s credentials in HTTP requests, which presents security risks.

**How:** All connected app integrations that use the username-password flow will no longer work. As an app developer, update your integrations to use a more secure flow. For end user login and authorization, use the OAuth 2.0 web-server flow with the Proof Key for Code Exchange (PKCE) extension. For server-to-server integrations, use the OAuth 2.0 client credentials flow. For apps that you didn't develop, contact the app developer.

To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select **Release Updates**. For Retirement of OAuth 2.0 Username-Password Flow for Connected Apps, follow the testing and activation steps.

#### See Also

- [Release Updates](https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&release=264.0.0&type=5 "Salesforce periodically provides release updates that improve the performance, logic, security, and usability of our products. The Release Updates page provides a list of updates that can be necessary for your organization to enable. Some release updates affect existing customizations.")