SF Auth Deadline

Salesforce integration sign-in changes · 2026–2027

Is your Salesforce org affected?

Probably, if anything signs in to Salesforce with a stored password, a rarely used refresh token or an older Connected App. Salesforce is tightening OAuth in stages: idle refresh tokens expire after 30 days from Nov 4, 2026, the username-password flow is retired on Feb 20, 2027, and Connected Apps reach end of support in Summer '27.

Check if you're affected See every date

Already know you're affected? Get the Connected App Retirement Kit, from $49.

Dates checked against Salesforce Help and release notes on .

Next deadline

Idle refresh tokens expire after 30 days (production)

Wed, Nov 4, 2026 · production, scratch & Developer Edition orgs (rolling)

Counts to midnight US Pacific time. Salesforce enforces many of these on a rolling basis, so your org may change on or after this date.

Username-password & user-agent flows retired on Feb 20, 2027, no opt-out.

The short answer

What is changing in Salesforce authentication?

Salesforce is retiring the old ways integrations sign in. From February 20, 2027, the OAuth 2.0 username-password flow and the user-agent flows stop working for Connected Apps, with no opt-out. Before that, idle refresh tokens expire after 30 days (production from November 4, 2026), the device flow is limited to local External Client Apps (November 30, 2026), and SOAP API login() needs the Use Any API Auth permission (December 1, 2026). Connected Apps reach end of support in Summer '27, when SOAP login() is also retired in API versions 31.0–64.0.

The fix for most integrations is to move to an External Client App with a supported server-to-server flow, usually the client credentials flow (KA 005461279), or the OAuth 2.0 JWT bearer flow if the client uses several usernames in one org (KA 000886201), or Named Credentials for callouts between orgs. Existing Connected Apps keep issuing tokens after Summer '27, but Salesforce stops fixing and supporting them.

The paid kit · from $49

Connected App Retirement Kit

The free pages tell you what is changing and when. The Connected App Retirement Kit is a self-serve download for doing the work: find every integration that still uses a password or a retiring OAuth flow, pick its replacement and cut over before February 20, 2027, without losing a week to research.

  • Integration Inventory Workbook (.xlsx) that calculates risk score, deadline and days remaining, and flags cutovers planned too late
  • 20 discovery queries (17 SOQL, 3 Tooling API), 10 Setup checks, 4 CLI commands and a read-only script that saves results to CSV
  • A seven-question decision tree and eight runbooks, including device flow, user-agent to web server + PKCE, refresh-token resilience and SOAP login()
  • Test, cutover and rollback checklists, five email templates and a 64-page guide (PDF and editable DOCX)

What's inside the kit

Real excerpts from the v1.1 download, not customer or org data. Selected workbook headings are shown below; the download contains the editable workbook and full runbooks.

Integration Inventory Workbook · selected column headings

  • Integration / System
  • Business owner
  • Technical owner
  • Current auth method
  • Run frequency
  • Deadline impact (calc)
  • Deadline date (calc)
  • Days remaining (calc)
  • Risk score (calc)
  • Target method
  • Target cutover date
  • Cutover vs deadline (calc)

Runbook H · Refresh-token resilience · H1, step 3

For each app and user, ask the owner how often the job runs. Put it in the Run Frequency column. The workbook raises the risk score for monthly or rarer jobs on refresh tokens.

Runbook C · Connected App to External Client App · C5

Repeat C4 in production in an approved window. Monitor Login History for the app's integration users for 24 hours.

The full kit also includes test, cutover and rollback checklists. Choose $49 Single-Org or $149 Consultant (unlimited client orgs).

$49Single-Org: one company, production and all its sandboxes
$149Consultant: unlimited client orgs
Get the kit

Instant digital download through Gumroad. Self-serve: support and consulting aren't included. Every date is traced to Salesforce's own documentation. Independent, not affiliated with Salesforce.

Pages from the Connected App Retirement Kit: the guide and an integration inventory workbook

Timeline

Every Salesforce authentication deadline, in order

Each date links to the Salesforce page it comes from. Salesforce has moved some of these before, so also check Setup → Release Updates in your own org.

  1. Since Spring '26In effect

    New Connected Apps can't be created

    New Connected Apps can't be created in Setup or via API, including Metadata API, since Spring '26 (except via package install or a Support request). New integrations must use External Client Apps. Existing Connected Apps keep working.

    Source: Salesforce Help KA 005228017

  2. Sandboxes

    Idle refresh tokens expire after 30 days: sandboxes

    Rolling enforcement in sandboxes. A refresh token unused for 30 days stops working and the integration must re-authorize. Integrations that don't use refresh tokens get access tokens capped at 30 days from last login.

    Source: Salesforce Help KA 005461275

  3. Upcoming

    Idle refresh tokens expire after 30 days: production

    Rolling enforcement in production, scratch and Developer Edition orgs. Monthly, quarterly or yearly jobs that rely on a stored refresh token fail with invalid_grant. Integrations that don't use refresh tokens get access tokens capped at 30 days from last login.

    Sources: KA 005461275 · Salesforce security roadmap (KA 005461287)

    Guide: how the 30-day idle limit works and how to check your org →

  4. Upcoming

    OAuth device flow restricted to local External Client Apps

    Only local External Client Apps with a localhost callback and no other OAuth flows enabled may use the device flow. Device-flow requests through Connected Apps and non-compliant External Client Apps are blocked.

    Sources: KA 005461280 · Release note

    Guide: is your device-flow app compliant? →

  5. Upcoming

    SOAP API login() requires the Use Any API Auth permission

    Users without the permission get INSUFFICIENT_ACCESS when they call SOAP login().

    Source: KA 005132110

    Guide: find SOAP login() users and fix INSUFFICIENT_ACCESS →

  6. Sandboxes

    SOAP login() security checks: sandboxes

    From a broad login IP range, SOAP login() needs a security token or mTLS (otherwise TOKEN_REQUIRED). A one-time check disables SOAP login() in orgs with no SOAP login() activity in the previous 6 months.

    Source: KA 005132110

    Guide: TOKEN_REQUIRED (1502) and the 6-month check →

  7. Production

    SOAP login() security checks: production

    The same token and 6-month inactivity rules reach production. If no one in the org used SOAP login() in the 6 months before the check, it's turned off, and Salesforce warns that rare jobs (annual, DR, seasonal) “can look inactive and then fail” (KA 005132110).

    Source: KA 005132110

    Guide: how to check your org before the production date →

  8. The big one

    Username-password and user-agent OAuth flows retired

    Token requests with grant_type=password fail with invalid_grant / “authentication failure”. Apps using the user-agent or hybrid user-agent flows stop authorizing. There is no opt-out after enforcement.

    Sources: KA 005461279 · KA 005461282 · Release note

    Guide: find username-password integrations with one SOQL query →

    Guide: move user-agent apps to the web-server flow + PKCE →

  9. Summer '27Day not yet published

    Connected Apps end of support · SOAP login() retired in API 31.0–64.0

    The “Migrate All Connected Apps to External Client Apps” release update is enforced for production. Connected Apps keep working but are no longer fixed or supported. SOAP login() stops working in API versions 31.0–64.0 (it's already gone in 65.0+).

    Sources: Release note · KA 005461287 · KA 005132110

Key facts

Quotable facts, each with its official source

  • Salesforce retires the OAuth 2.0 username-password flow for Connected Apps on February 20, 2027, with no opt-out after enforcement.

    Source: Salesforce Help KA 005461279

  • Salesforce limits the refresh token idle time to 30 days, enforced on a rolling basis from October 21, 2026, in sandboxes and November 4, 2026, in production.

    Source: Salesforce Help KA 005461275

  • From November 30, 2026, the OAuth 2.0 device flow only works with local External Client Apps.

    Source: Salesforce Help KA 005461280

  • From December 1, 2026, SOAP API login() requires the Use Any API Auth permission, and it is retired in API versions 31.0–64.0 in Summer '27.

    Source: Salesforce Help KA 005132110

  • Connected Apps reach end of support in Summer '27. Existing apps keep working, but Salesforce no longer fixes or supports them.

    Source: Winter '27 release note

  • Since Spring '26, new Connected Apps can't be created in Setup or via API (except via package install or a Support request).

    Source: Salesforce Help KA 005228017

60-second self-check

Who is affected?

Your org is affected if any of these is true. Tick what applies. This runs only in your browser: nothing is saved or sent.

What breaks

What actually fails, and what you'll see

The integration itself gets no warning. It simply stops signing in, often in a job nobody has looked at in months. Setup shows Release Update entries, and device-flow apps show banners, but only if someone looks.

Nov 4, 2026 · production

Rarely used refresh tokens

What fails
Integrations that run monthly, quarterly or yearly on a stored refresh token.
You'll see
invalid_grant / “expired access/refresh token”. A user has to re-authorize the app.
Direction
Find low-frequency jobs now; move server-to-server jobs to JWT bearer or client credentials, which don't rely on refresh tokens; they simply request a new token when the old one expires.

KA 005461275

Nov 30, 2026

Device flow on Connected Apps

What fails
Command-line tools, smart TVs, appliances and other IoT devices (Salesforce Help: OAuth 2.0 Device Flow for IoT Integration) that sign in with the device flow through a Connected App or a non-compliant External Client App.
You'll see
Device-flow requests are blocked; the app is flagged non-compliant.
Direction
A local External Client App with a localhost callback and only the device flow enabled.

KA 005461280

Dec 1, 2026 → Summer '27

SOAP API login()

What fails
Clients that sign in with SOAP login(): older data loaders, connectors and scripts.
You'll see
INSUFFICIENT_ACCESS (missing permission), TOKEN_REQUIRED (broad IP range), then no login at all in API 31.0–64.0.
Direction
Assign Use Any API Auth as a bridge, then move the client to OAuth on an External Client App.

KA 005132110

Feb 20, 2027

Username-password flow

What fails
Anything that posts grant_type=password to /services/oauth2/token: middleware, ETL, scripts, org-to-org Apex.
You'll see
invalid_grant / “authentication failure”; Login History status “OAuth Username-Password Flow Disabled”.
Direction
Client credentials (server-to-server) or web server + PKCE (user login) per KA 005461279, or JWT bearer for multiple usernames per KA 000886201, on an External Client App. Salesforce says the username-password flow won't be made available for External Client Apps.

KA 005461279 · KA 000886201 · Help: Connected Apps vs External Client Apps

Feb 20, 2027

User-agent & hybrid flows

What fails
Browser and mobile apps that use the user-agent or hybrid user-agent flow.
You'll see
The app stops authorizing users.
Direction
Web server flow (or hybrid web server flow) with PKCE.

KA 005461282

Summer '27

Connected Apps

What fails
Nothing switches off on the day, but Salesforce stops fixing and supporting Connected Apps and their flows.
You'll see
A release update to migrate all Connected Apps to External Client Apps.
Direction
Migrate in-house apps (keys, secrets and refresh tokens carry over); chase vendors for managed-package apps.

Migration docs

What does not change

  • Existing Connected Apps don't stop issuing tokens in Summer '27. End of support is a risk, not an outage.
  • JWT bearer, client credentials and web server flows keep working on Connected Apps and External Client Apps.
  • Salesforce's migration tool keeps the consumer key, secret and refresh tokens, so supported integrations don't re-authenticate.
  • But moving to an External Client App doesn't rescue a password-based integration: the client itself has to change flow.
First page of the free 15-Minute Integration Auth Risk Check PDF

Free resource

The 15-Minute Integration Auth Risk Check

Six checks in Setup that show whether any integration in your org will stop signing in on Salesforce's upcoming dates. No sign-up, no email: just the PDF.

  • Every date on one page, with its Salesforce source
  • Exactly where to look: Login History, App Manager, OAuth usage, Release Updates
  • What each finding means and which date it maps to
Download the free checklist

PDF · 2 pages · 135 KB · updated October 29, 2026

Official Salesforce sources

Found affected integrations? The Connected App Retirement Kit has the inventory workbook, discovery queries, decision tree and runbooks to migrate them: $49 Single-Org or $149 Consultant (unlimited client orgs). What's inside.

Optional deadline-update signup

Join the interest list on Gumroad for future Salesforce authentication deadline updates and kit news. The free checklist stays available without signing up.

Join the email interest list on Gumroad

Gumroad collects your email and handles confirmation and unsubscribe. Updates are not sending yet: Gumroad requires $100 earned after fees and a received payout before creators can send emails. Do not rely on this list for deadline reminders; check the timeline directly.

FAQ

Frequently asked questions

When does Salesforce retire the OAuth username-password flow?

On February 20, 2027. After enforcement, Connected App integrations that use the username-password flow can no longer get access tokens, and there is no opt-out. Token requests fail with invalid_grant / “authentication failure”. Source: Salesforce Help KA 005461279.

Are Connected Apps going away?

Not on a single day. New Connected Apps can't be created in Setup or via API since Spring '26 (except via package install or a Support request), and Connected Apps reach end of support in Summer '27. Existing Connected Apps keep working after that, but Salesforce no longer fixes bugs or supports them, so the recommended path is to migrate to External Client Apps. Sources: KA 005228017, Winter '27 release note.

What is the 30-day refresh token change?

Salesforce limits refresh token idle time to 30 days. A refresh token that hasn't been used for 30 days expires and the integration has to re-authorize. Enforcement rolls out from October 21, 2026, in sandboxes and November 4, 2026, in production, scratch and Developer Edition orgs. Jobs that run monthly, quarterly or yearly are most at risk. Integrations that don't use refresh tokens get access tokens capped at 30 days from last login; they simply request a new token when the old one expires. Source: KA 005461275.

How do I know if my org is affected?

Check Login History for Login Subtypes OAuth Username-Password, OAuth User-Agent, OAuth Device or SOAP API; check App Manager for apps with App Type Connected; and list any integration that runs less often than every 30 days on a saved refresh token. If any of these turn something up, you're probably affected. A device-flow app is fine if it's already a compliant local External Client App. The self-check above and the free checklist walk through it.

What should replace the username-password flow?

For server-to-server integrations, the client credentials flow (KA 005461279) or the OAuth 2.0 JWT bearer flow if the client uses several usernames in one org (KA 000886201), on an External Client App. Client credentials needs your My Domain URL. For end-user login in browser and mobile apps, use the web server flow with PKCE (KA 005461279). For callouts from one Salesforce org to another, use Named Credentials. Salesforce says the username-password flow won't be made available for External Client Apps.

Does migrating a Connected App to an External Client App break existing integrations?

Not for integrations on supported flows. Salesforce's migration keeps the consumer key, consumer secret and refresh tokens, so those integrations don't need to re-authenticate. It does not rescue an integration that uses the username-password flow: that client has to switch to a supported flow first. Source: Connected App to External Client App Migration.

What happens to SOAP API login()?

From December 1, 2026, it requires the Use Any API Auth permission. From December 15, 2026 (sandboxes) and January 31, 2027 (production), logins from broad IP ranges need a security token or mTLS, and SOAP login() is disabled in orgs that haven't used it in 6 months. In Summer '27 it is retired in API versions 31.0–64.0. Source: KA 005132110.

What about apps from managed packages and vendors?

Salesforce says it's the package vendor's responsibility to provide a migrated External Client App version. Find those apps in App Manager now and ask each vendor for their date, since you can't fix their app yourself. Source: KA 005228017.

Is this site affiliated with Salesforce?

No. It's an independent resource that summarizes Salesforce's public documentation and links to it for every date. If Salesforce's pages and this site disagree, Salesforce's pages win.