Since Spring '26, Salesforce no longer lets you create new connected apps in Setup or the Metadata API. Existing connected apps are not switched off, but three later dates can break them (see below). Salesforce points new integrations to External Client Apps (Salesforce Help: connected apps can no longer be created).
A connected app is the Salesforce record that lets an outside tool sign in to your org.
Clientell AI, the AI Salesforce admin, audits your connected apps and permissions in a free, read-only scan. See the Salesforce health check. New to the term? Read the connected app definition.
What exactly changed in Spring '26?
New orgs had connected app creation off by default, and an admin had to turn on "Allow creation of connected apps". From Spring '26, Salesforce stops you from turning that setting on unless you ask Salesforce Support. The block covers both the UI and the API. Installing a package that contains a connected app still works.
What keeps working?
| Item | Status after Spring '26 |
|---|---|
| Connected apps you already have | Not switched off by Spring '26. See the dates below |
| Connected apps that come inside an installed package | Can still be installed |
| New connected apps (Setup or Metadata API) | Blocked unless Salesforce Support enables it |
| External Client Apps | The route Salesforce recommends for new integrations |
Salesforce says Support will no longer be able to turn creation back on in future releases. A Support exception buys time, and it does not replace a plan.
What breaks first?
Anything that creates a connected app on its own. Check these three places:
- Deploy scripts and CI jobs that push the ConnectedApp metadata type into a new org or sandbox. Expect the deploy to fail with a creation error.
- Setup runbooks that say "create a connected app" for a new tool. Change each step to "create an External Client App".
- Tools that ask for a connected app's consumer key. A new integration in a fresh sandbox is the usual case.
An existing app keeps working until one of the dates below reaches it. A new sandbox or a new tool is where you will see the Spring '26 error first.
What is an External Client App, and how is it different?
An External Client App (ECA) is the newer way to let an outside app sign in with OAuth (open authorization, the standard sign-in handshake). It splits the developer's settings from the admin's policies. That makes packaging and security review easier. Salesforce also publishes a guide to move existing connected apps to ECAs.
The Salesforce hosted MCP server (MCP is Model Context Protocol, the way AI tools call outside systems) needs an ECA too. Our comparison of Clientell MCP and the hosted MCP server covers that setup step.
Which dates still hit existing connected apps?
Three later changes can break apps you already have. Salesforce lists each date in its security roadmap. For the password flow, Salesforce also shows how to switch to the client credentials flow.
| Date | Change | Who breaks |
|---|---|---|
| 21 Oct 2026 (sandboxes), 4 Nov 2026 (production) | A refresh token not used for 30 days expires. | Jobs that run less than monthly, such as quarterly syncs |
| 30 Nov 2026 | The OAuth device flow is limited to local External Client Apps. | Connected apps that sign in with a device code |
| 20 Feb 2027 | The username-password and user-agent flows are retired. | Integrations that still log in with a password or a browser redirect |
Check each app's OAuth flow and last token use before those dates. The list in the next section gives you both.
How do I list every connected app in my org?
Both views are read-only, so nothing in your org changes.
- Open Setup > App Manager to see each app.
- Open Setup > Connected Apps OAuth Usage to see which apps hold tokens and when each was last used.
- Write down an owner for each app, such as the admin or the vendor contact, in a shared sheet. Mark the apps with no recent token use.
- Block or remove apps with no owner and no recent use. If a job fails afterwards, re-enable the app from Setup > App Manager while you find the owner.
What is the plan?
The rule is simple: no new connected apps, and every existing one gets an owner.
- Stop making new connected apps. Make External Client Apps.
- Fix every script that creates a connected app.
- Move the apps with the most token activity first, one at a time, in a sandbox.
- Review who holds powerful permissions on the apps you keep.
How do I move safely?
Start with a read-only scan, since listing apps changes nothing in your org. Clientell AI asks before it changes anything in production, and our security page lists the controls. Test each ECA move in a sandbox first, with a way back. For one app, the order is:
- Note the old app's OAuth scopes, callback URL and who holds tokens.
- Create the External Client App in the sandbox with the same scopes and callback URL.
- Point the integration at the new consumer key and run its job once.
- Expect a normal sign-in and a fresh token in Connected Apps OAuth Usage.
- If the job fails, switch the integration back to the old app. The old app is untouched until you remove it. Read our privacy policy.
Try it in Clientell AI: "List every connected app in my org, show when each last held a token, and flag the ones with no recent use."
Start the 14-day free trial, no card needed.
Common questions about Spring '26 connected app changes
Will my existing connected apps stop working?
Not because of Spring '26, which does not affect them. Three later dates matter, per Salesforce's security roadmap. Idle refresh tokens expire from 4 November 2026. Device flow is limited on 30 November 2026. The username-password flow ends on 20 February 2027.
Why is the New Connected App button greyed out?
Because creation is off by default since Spring '26. Use an External Client App, or ask Salesforce Support for an exception.
Do I need to move to External Client Apps now?
For new integrations, yes. For existing apps, Salesforce says they keep working, so list them first and inventory what you own. Then move the busiest ones one at a time.
How do I find which connected apps hold tokens?
Open Setup, then Connected Apps OAuth Usage. It shows which apps hold tokens and when each was last used. Apps with no owner and no recent use are the first to block or remove.
Can Salesforce Support still enable new connected apps?
For now, yes, on request. Salesforce says Support will not be able to do this in future releases, so treat an exception as a short delay. The details are in Salesforce Help.
Last updated: October 22, 2026
