Salesforce OAuth changes in 2026: 4 Nov, 30 Nov and 20 Feb
From 4 Nov 2026, an integration that has not refreshed its Salesforce OAuth token in 30 days has to sign in again (sandboxes: 21 Oct). On 30 Nov, device-flow logins stop working for connected apps. On 20 Feb 2027, three older sign-in flows are retired. Ask each owner whether the integration refreshes its token.
Dates
Which Salesforce OAuth dates matter in 2026 and 2027?
| Date | What changes | Who is affected | Source (checked 28 Oct 2026) |
|---|---|---|---|
| 21 Oct 2026Started | Refresh tokens that have not been used for 30 days expire, in sandboxes. Salesforce enforces this on a rolling basis. | Affected: Integrations connected to sandboxes. | Salesforce Help 005461275 |
| 4 Nov 2026Upcoming | The same 30-day limit starts in production, scratch and Developer Edition orgs, on a rolling basis. An integration that has not refreshed its token in 30 days has to sign in again. | Affected: Integrations connected to production, scratch and Developer Edition orgs. | Salesforce Help 005461275Roadmap 005461287 |
| 30 Nov 2026Upcoming | The OAuth 2.0 device flow works only with a local External Client App with a localhost callback URL. Device-flow logins stop working for connected apps. | Affected: Connected apps and packaged External Client Apps that sign in with the device flow. | Roadmap 005461287 |
| 20 Feb 2027Upcoming | Three older sign-in flows are retired: username-password, user-agent and hybrid user-agent. | Affected: Any app or script that signs in with one of those three flows. | Salesforce Help 000886201Roadmap 005461287 |
| Summer ’27Summer 2027 | Context only: Salesforce’s roadmap lists end of support for connected apps and points to External Client Apps. | Affected: Everyone with connected apps. Not one of the dates above. | Roadmap 005461287 |
Salesforce enforces the refresh-token limit on a rolling basis, so an org can see it at any point from the date shown.
Checklist
How do you check your integrations before 4 Nov?
Work through it org by org. Setup menu names can differ slightly between releases.
- 01
List your connected apps in every org.
In Setup, open Apps, then App Manager, and list each connected app. Open Connected Apps OAuth Usage to see which apps your users have authorized and when each user first used the app. Do this in production and in each sandbox, scratch org and Developer Edition org. If you already use External Client Apps, list those from the External Client App Manager too.
- 02
Name the integration owner for each one.
One person or team who can answer questions about that integration and sign it in again. If nobody owns an app, write that down. An app with no owner is the first one to look at.
- 03
Ask the owner which sign-in flow it uses.
For example: web server, JWT bearer, device, username-password, user-agent. The 30 Nov and 20 Feb dates depend on the flow. Do not guess it from the app name.
- 04
Ask the owner whether it refreshes its token, and how.
The 30-day limit applies to a refresh token that has not been used. How often a job runs does not tell you whether, or when, it uses its refresh token, so confirm the actual refresh-token use with the owner.
- 05
Mark each app against the dates.
Note whether it is affected by the refresh-token limit, the device-flow change, the three retired flows, or none. Keep the owner’s answer next to it.
- 06
Plan the re-authorization.
For every app that may need to sign in again: who does it, with which Salesforce user, and in which order. Sandboxes are enforced first, so they show what the sign-in looks like before production.
- 07
Write the result down and re-check the sources.
Keep the list with its date. Salesforce has moved dates in this area before, so read the linked articles again before each deadline.
Device flow
What changes for the device flow on 30 Nov?
On 30 Nov, device-flow logins stop working for connected apps. Salesforce limits the OAuth 2.0 device flow to a local External Client App with a localhost callback URL. Connected apps and packaged External Client Apps lose it.
The device flow shows a short code on one screen and asks you to approve it on another. Ask each integration owner whether their tool signs in that way. If it does, ask whether it can move to a local External Client App with a localhost callback URL.
Retired sign-in flows
Which sign-in flows are retired on 20 Feb 2027?
On 20 Feb 2027, three older sign-in flows are retired: the username-password flow, the user-agent flow and the hybrid user-agent flow. Salesforce moved this enforcement date, so read its note again before you plan around it.
A script that sends a username and password to Salesforce is the usual case for the username-password flow. Ask the owner what it signs in with, then plan a replacement flow with them.
Ways to audit connected apps
What can each place in Salesforce tell you?
| Where to look | What it shows | What it does not show |
|---|---|---|
| App Manager list | Shows: Which connected apps exist in the org, and their names. | Does not show: Which sign-in flow an app uses, or whether it refreshes its token. |
| Connected Apps OAuth Usage | Shows: Which apps your users have authorized, and when each user first used the app. | Does not show: Whether, or how often, the integration refreshes its token. |
| Login History | Shows: Logins you can filter by Application, Login Type and Login Subtype, to see which integration users log in. | Does not show: The owner, or whether the integration refreshes its token. |
| Asking the integration owner | Shows: The sign-in flow, the refresh behavior and who can sign it in again. | Does not show: Apps nobody owns. Use the lists above to find those first. |
What we checked and when
Last verified 28 Oct 2026
On 28 Oct 2026 we read these Salesforce pages and compared every date in the table with them: the refresh-token article (005461275), the roadmap article (005461287) and the sign-in flow article (000886201). We re-read them before changing a date here. The wording of this page also updates by itself as each date passes.
Change log
- 28 Oct 2026: Published. Dates checked against the three Salesforce articles above.
FAQ
Common questions
Do I have to re-authorize every integration on 4 Nov?
No. The limit applies to a refresh token that has not been used for 30 days. Ask each integration owner about its actual refresh-token use. Do not infer it from how often the job runs.
Does the 30-day limit apply to sandboxes too?
Yes. Salesforce enforces it on a rolling basis starting on 21 Oct 2026 in sandboxes. Production orgs, scratch orgs and Developer Edition orgs follow from 4 Nov 2026.
Are connected apps going away?
Salesforce’s roadmap lists end of support for connected apps in Summer ’27 and points to External Client Apps. That is Summer 2027, and it is context here, not one of the dates in the table.
Related: a Salesforce permissions audit also covers integration users with admin-level access. Background on the Spring ’26 connected-app changes is in our connected-app blog post.
Want a second pair of eyes on your org?
Clientell Platform reads records live under your own Salesforce permissions. Nothing changes in your org without your approval. The trial runs 14 days, no card, and the clock starts when you connect your first org.