Short answer: Salesforce’s public roadmap lists Connected Apps end of support for Summer '27 (all environments)—a season, not a single published calendar day. External Client Apps (ECAs) are the successor app type for new integrations. End of support is not the same as “every Connected App stops authenticating on a fixed day in 2026,” and it is separate from the February 20, 2027 username-password and user-agent flow retirements. (Roadmap: KA 005461287.)
Independent resource. Not affiliated with Salesforce. Confirm dates in your org under Setup → Release Updates.
What changes
Connected Apps end of support (Summer '27)
On the Connected App & External Client App security roadmap, the migration group row is labeled Connected Apps End-of-Support with enforcement timeline Summer '27 (All Environments). Salesforce does not publish a specific day on that roadmap table. Treat it as the Summer '27 season until Salesforce publishes a day. Source: KA 005461287.
What “end of support” means in practice (high level): Per KA 005228017 FAQ, with end of support existing Connected Apps continue to function, but Salesforce no longer provides bug fixes, security updates, or technical support. EOS does not mean apps stop working. Season only on the roadmap: KA 005461287. Do not upgrade that to “all integrations fail in Summer '27.”
New Connected Apps already limited (since Spring '26)
New Connected Apps can’t be created in Setup or via API (including Metadata API) since Spring '26, except via package install or a Support request—so new work is expected on External Client Apps. Source: KA 005228017.
External Client Apps are the replacement app type—not a magic fix for retired flows
Moving an integration onto an External Client App does not by itself rescue a password-based or retiring flow. Salesforce’s username-password retirement article points replacements such as client credentials or web server + PKCE (KA 005461279). Switch the client to a supported flow before you rely on an External Client App for that integration.
When (how this sits next to other deadlines)
| Date / season | Change | Relation to Connected Apps vs ECAs |
|---|---|---|
| Spring '26 (in effect) | New Connected App creation restricted (per KA 005228017) | New builds → External Client Apps |
| November 30, 2026 | Device flow only on compliant local ECAs | Connected Apps with device flow are non-compliant (KA 005461280) |
| February 20, 2027 | Username-password and user-agent flow retirements | Flow problem on the client, not solved by app-type rename alone (KA 005461279, KA 005461282) |
| Summer '27 | Connected Apps end of support | Roadmap season (KA 005461287) |
Who is affected
- Teams still planning new Connected Apps in Setup or Metadata API.
- Orgs with a long tail of legacy Connected Apps that will need an ECA migration plan before support ends.
- Package / ISV vendors responsible for shipping External Client App versions to subscribers.
- Admins who assume “we migrated the app type, so password grant is fine”—that assumption is wrong for February 20, 2027.
Not every org is equally urgent on every row. Device-flow and password-grant estates feel earlier dates first; Summer '27 is the support-posture deadline for Connected Apps as a product surface.
What this page does not cover
No Setup click-path, no automated migration wizard steps, no inventory queries. Those belong in Salesforce Help and, for a packaged project template, in the paid kit—not in free SEO pages.
Related articles on this site
- Full Connected App retirement timeline
- Who is affected
- Username-password flow retirement
- Device flow restrictions
Sources
- KA 005461287 — roadmap (Connected Apps End-of-Support, Summer '27)
- KA 005228017 — Spring '26 create-block + EOS FAQ (continue to function; no bug fixes / security updates / technical support)
- KA 005461279 — February 20, 2027 username-password retirement + replacement flows
- KA 005461280 · KA 005461282
Last checked: November 5, 2026, against the Salesforce pages above. If a Salesforce page and this article disagree, go by the Salesforce page.
Want a light self-check first? The free 15-Minute Integration Auth Risk Check covers Connected Apps, External Client Apps, and the near-term OAuth dates. The paid Connected App Retirement Kit ($49 Single-Org, $149 Consultant) is linked from sfauthdeadline.com.
sfauthdeadline.com is an independent resource. It is not affiliated with, endorsed by or sponsored by Salesforce. Salesforce is a trademark of Salesforce, Inc.