Short answer: Salesforce is tightening how integrations authenticate through Connected Apps and External Client Apps across late 2026 and 2027. The changes are staged: idle refresh-token limits (production rolling from November 4, 2026), device-flow restrictions (November 30, 2026), SOAP login() permission and security checks (December 1, 2026 onward), username-password and user-agent flow retirements (February 20, 2027), then Connected Apps end of support in Summer '27 (season only; no exact day on the roadmap). Existing Connected Apps are not all shut off on one day, and supported OAuth flows keep working. (Roadmap: Salesforce Help KA 005461287.)
Independent resource. Not affiliated with Salesforce. Facts below were checked against Salesforce Help; always confirm in Setup → Release Updates in your own org.
What this page covers (and what it does not)
This is a what / when / who map of the public roadmap. It does not walk through Setup menus, SOQL, or migration steps. For per-deadline detail already on this site, use the linked articles. For a free light self-check, download the 15-Minute Integration Auth Risk Check from sfauthdeadline.com. Inventory workbooks, discovery query packs, and migration runbooks stay in the paid kit linked from that site.
Timeline at a glance
| When | What changes | Who feels it first | Primary Salesforce source |
|---|---|---|---|
| Sandboxes rolling from October 21, 2026; production, scratch, and Developer Edition rolling from November 4, 2026 | Refresh tokens unused for 30 days expire (idle TTL). Tokens already idle more than 30 days can expire at enforcement. Not a same-day cutover for every org. | Background jobs and rarely used OAuth apps that store refresh tokens | KA 005461275, roadmap KA 005461287 |
| November 30, 2026 | OAuth 2.0 device flow restricted to compliant local External Client Apps | CLI, IoT, and other device-flow clients on Connected Apps or non-compliant apps | KA 005461280 |
| December 1, 2026 | SOAP API login() needs the Use Any API Auth user permission, or requests fail with INSUFFICIENT_ACCESS |
Integrations still calling SOAP login() without that permission |
KA 005132110 |
| December 15, 2026 (sandboxes) / January 31, 2027 (production) | Additional SOAP login() security checks (including TOKEN_REQUIRED / 1502 from broad IP ranges, plus a one-time inactivity check) |
Username/password SOAP clients; orgs with rare SOAP login() use |
KA 005132110 |
| February 20, 2027 | OAuth 2.0 username-password flow retired (no opt-out after enforcement) | Server-side scripts and connectors using grant_type=password on Connected Apps |
KA 005461279 |
| February 20, 2027 | OAuth 2.0 user-agent and hybrid user-agent flows retired | SPAs and mobile clients still on those flows | KA 005461282 |
| Summer '27 (all environments; season only) | Connected Apps end of support; SOAP login() retirement in API versions 31.0–64.0 is also tied to this season on related docs |
Teams still creating or depending on unsupported Connected App posture; SOAP clients on old API versions | Roadmap row in KA 005461287; SOAP versions in KA 005132110 |
Important nuances (easy to get wrong)
- November 4, 2026 is a rolling production start for idle refresh-token enforcement, not a claim that every org flips at midnight. Sandboxes started earlier (October 21, 2026). Source: KA 005461275 / KA 005461287.
- Idle expiry is not “all tokens die on November 4.” Salesforce’s October 26, 2026 clarification: at enforcement it expires refresh tokens idle more than 30 days, and for flows without refresh tokens it expires access tokens whose last login was more than 30 days ago—not every access token. Source: KA 005461275 change log (verified November 4–5, 2026).
- SOAP has several distinct dates. December 1 (Use Any API Auth) is separate from December 15 / January 31 security checks, and separate again from Summer '27 API-version retirement. Source: KA 005132110.
- Summer '27 Connected Apps end of support is a season, not a published calendar day on the KA 005461287 roadmap table. Do not invent a day.
- End of support is not the same as “all integrations stop” or “all Connected Apps are deleted now.” Per KA 005228017 FAQ: with end of support, existing Connected Apps continue to function, but Salesforce no longer provides bug fixes, security updates, or technical support. EOS does not mean apps stop working. Season only: KA 005461287.
Who is affected
- Salesforce admins and architects who own App Manager / External Client App Manager and Release Updates.
- Integration developers maintaining middleware, ETL, iPaaS connectors, scripts, SPAs, or mobile SDKs that authenticate into Salesforce.
- Consultants running the same inventory across many client orgs.
- ISV / package vendors whose Connected Apps or device-flow clients sit in subscriber orgs (vendors own compliant replacements for packaged apps).
If nothing in your estate uses password grants, device flow, SOAP login(), long-idle refresh tokens, or user-agent flows, many of the near-term dates may not touch you—but Summer '27 Connected Apps end of support still matters for long-term support posture.
Related articles on this site (depth, not duplicates)
- Refresh tokens: 30-day idle expiry
- Device flow restrictions
- SOAP login() and Use Any API Auth
- SOAP login() TOKEN_REQUIRED / 1502
- Username-password flow retirement
- User-agent flow retirement
- Connected Apps vs External Client Apps
- Who is affected by these auth deadlines
Sources
- KA 005461287 — Connected App & External Client App Security Requirement Updates (roadmap)
- KA 005228017 — Connected Apps create restriction + EOS FAQ (continue to function; no bug fixes / security updates / technical support)
- KA 005461275 — Refresh Token Idle TTL
- KA 005461280 — Device flow restrictions
- KA 005132110 — SOAP API login() retirement & security requirements
- KA 005461279 — Username-password flow retirement
- KA 005461282 — User-agent flow retirement
Last checked: November 5, 2026, against the Salesforce pages above. If a Salesforce page and this article disagree, go by the Salesforce page.
Want a light self-check first? The free 15-Minute Integration Auth Risk Check covers these deadlines with no sign-up. The paid Connected App Retirement Kit ($49 Single-Org, $149 Consultant) is linked from sfauthdeadline.com.
sfauthdeadline.com is an independent resource. It is not affiliated with, endorsed by or sponsored by Salesforce. Salesforce is a trademark of Salesforce, Inc.