The OAuth 2.0 user-agent and username-password flows are considered insecure and aren’t
recommended. For better security, we strongly recommend that you block these flows in Salesforce
to prevent developers from using them to build new integrations. If your org is created in
Summer ‘23 or later, the username-password flow is blocked by default. You can enable the
username-password flow if needed. If you have existing integrations that use the user-agent or
username-password flow, update them to a more secure OAuth 2.0 flow. You can also block the
Authorization Code and Credentials Flow, which is used to securely configure a headless login
process. And you can block certain flows that don’t use the PKCE extension.
Required Editions
| Available in: both Salesforce Classic and Lightning Experience |
| Available in: All Editions |
Blocking a flow can break managed packages, mobile apps, and other integrations that use
it. Blocking the user-agent flow also blocks the hybrid app token flow. Before implementing
your changes in production, test them thoroughly in a sandbox. In place of the user-agent
flow for external web apps, we recommend using the OAuth 2.0 web server flow with Proof Key
for Code Exchange (PKCE.) In place of the username-password flow, we recommend using OpenID
Connect dynamic client registration or the OAuth 2.0 client credentials flow. For a list of
alternative OAuth flows and their use cases, see OAuth Authorization
Flows.
- From Setup, in the Quick Find box, enter OAuth, and then select
OAuth and OpenID Connect Settings.
- To block a flow, turn off its associated setting. To enable a blocked flow, turn on its
associated setting. Here’s a list of the settings.
- Allow OAuth User-Agent Flows—We recommend updating your integrations and blocking
this flow.
- Allow OAuth Username-Password Flows—We recommend updating your integrations and
blocking this flow too.
- Allow Authorization Code and Credentials Flows—Block this flow only if you aren’t
using it.
- Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization
Flows—This setting doesn’t explicitly block or enable a specific flow. Instead, when
enabled, it blocks all variations of the OAuth 2.0 authorization code flow that don’t
implement the PKCE extension. These variations include the web server flow, the hybrid
web server flow, the Authorization Code and Credentials Flow, and all variations of
the Authorization Code and Credentials Flow. This setting is a prerequisite for
requiring the PKCE extension for a connected app and for using PKCE for an
authentication provider. For more information, see Proof Key for Code Exchange (PKCE) Extension.
- At the prompt from your browser, click OK to confirm that you’re
ready to implement this change.
You can allow these flows at any time, but we don’t recommend ever allowing the user-agent
or username-password flows. To use the Authorization Code and Credentials Flow, you must
explicitly allow it.
