Short answer: If your Salesforce estate has integrations that sign in with OAuth or SOAP, you are in the audience for the 2026–2027 auth changes. The people who feel it first are admins and architects who own apps and Release Updates, developers who maintain connectors and scripts, and consultants / ISVs who ship or support those apps across orgs. Refresh-token idle expiry (production rolling from November 4, 2026) hits rarely used background jobs especially hard; later dates target device flow, SOAP login(), and password / user-agent OAuth. (Sources: KA 005461275, roadmap KA 005461287.)
Independent resource. Not affiliated with Salesforce.
Refresh token expiry: who should care (and what “expiry” means here)
Salesforce is enforcing a 30-day idle refresh-token limit for Connected Apps and External Client Apps. In production, scratch, and Developer Edition orgs, enforcement began on a rolling basis starting November 4, 2026 (sandboxes from October 21, 2026). A refresh token that has not been used for 30 days expires; at enforcement, tokens already idle more than 30 days can expire immediately. This is not a claim that every org cut over on November 4, and it is not “Salesforce deleted every access token on that date.” Salesforce clarified on October 26, 2026 that it does not expire all access tokens at enforcement. Source: KA 005461275.
Most at risk
- Scheduled or seasonal jobs that store a refresh token and run less often than every 30 days (quarterly loads, DR drills, month-end tools).
- Interactive apps that sit unused for a month, then fail on next open with
invalid_grant/ expired access/refresh token messaging (per KA 005461275). - Integrations without refresh tokens, whose access tokens are capped relative to last login (JWT bearer and client credentials are not simply “exempt”—they must handle expiry by running again).
Lower urgency for this specific control
- High-churn interactive apps that refresh well inside 30 days.
- Teams with no OAuth refresh-token usage at all (they may still be in scope for other rows below).
Deep dive (includes checking guidance already published on this site): Salesforce refresh tokens expire after 30 days idle.
Who is affected by the rest of the roadmap
| Audience | Why they show up | Dates that usually matter first |
|---|---|---|
| Salesforce admins / platform owners | Own App Manager, External Client App Manager, Login History, Release Updates | All rows; especially Nov 30 device flow and Summer '27 support posture |
| Integration / middleware developers | Own ETL, iPaaS, MuleSoft-style connectors, custom scripts | Nov 4 idle refresh; Feb 20, 2027 username-password; SOAP dates if still on login() |
| Front-end / mobile developers | Own SPAs and mobile OAuth | Feb 20, 2027 user-agent / hybrid user-agent (KA 005461282) |
| Security / IAM | Own token lifetime and least-privilege reviews | Idle refresh TTL; device-flow lockdown (KA 005461280) |
| Consultants | Same patterns across many client orgs | Entire calendar; Consultant kit license is built for this |
| ISV / AppExchange vendors | Packaged Connected Apps / device-flow clients in subscriber orgs | Device flow Nov 30; ECA migration / Summer '27 support |
What / when cheat sheet (no how-to)
- Rolling from November 4, 2026 (production): 30-day idle refresh-token TTL — KA 005461275
- November 30, 2026: device flow limited to compliant local External Client Apps — KA 005461280
- December 1, 2026: SOAP
login()requires Use Any API Auth — KA 005132110 - December 15, 2026 (sandbox) / January 31, 2027 (production): further SOAP
login()security checks — KA 005132110 - February 20, 2027: username-password flow retired; user-agent / hybrid retired — KA 005461279, KA 005461282
- Summer '27: Connected Apps end of support (season only) — KA 005461287
Full date map: Salesforce Connected App retirement timeline 2026–2027.
Sources
Last checked: November 5, 2026, against the Salesforce pages above. If a Salesforce page and this article disagree, go by the Salesforce page.
Not sure which bucket you are in? Start with the free 15-Minute Integration Auth Risk Check. The paid Connected App Retirement Kit ($49 Single-Org, $149 Consultant) is linked from sfauthdeadline.com.
sfauthdeadline.com is an independent resource. It is not affiliated with, endorsed by or sponsored by Salesforce. Salesforce is a trademark of Salesforce, Inc.