Salesforce user-agent flow retirement (20 February 2027): moving SPAs and mobile apps to web-server flow + PKCE

Q: Why don't some failed attempts appear in Login History?

The User-Agent Flow Disabled status is recorded only for authenticated users. Check application logs and failed /services/oauth2/authorize redirects as well.

Short answer: Salesforce is retiring the OAuth 2.0 user-agent flow and the hybrid user-agent flow. Existing integrations in older orgs keep working only until 20 February 2027, and there is no opt-out after that. Salesforce also begins blocking both flows in newly created orgs starting with the Winter '27 release. Move user-agent integrations to the web-server flow with PKCE, and hybrid user-agent integrations to the hybrid web-server flow with PKCE. (Source: Salesforce Help KA 005461282.)

This deadline falls on the same day as the username-password flow retirement, but the work often sits with a different team. User-agent apps tend to belong to front-end and mobile developers, while username-password jobs tend to belong to integration and admin teams.

What changes

KA 005461282 says these flows "expose access tokens directly to the browser," which is why Salesforce is retiring them. After enforcement:

Integrations using either flow can't complete authorization and stop working.
The redirect to /services/oauth2/authorize fails.
For authenticated users, Login History shows User-Agent Flow Disabled. Attempts by unauthenticated users aren't recorded.
The error changes from invalid_grant / user-agent flow has been disabled by your Salesforce admin (if an admin blocked it early) to invalid_grant / user-agent flow has been disabled by Salesforce (after Salesforce enforces it).

Who's affected

Any integration that shows one of these Login Subtypes, in any edition, in Lightning Experience and Salesforce Classic:

OAuth User-Agent
OAuth User-Agent for Hybrid Apps
OAuth User-Agent with ID Token

Custom integrations and apps installed from managed packages are both included. If you don't own an affected app, Salesforce says to contact its developer for an updated version.

In general, the user-agent flow returns the access token in the redirect URL, so it suits clients with no back-end server. Single-page JavaScript apps, desktop or mobile apps and some embedded or browser-based tools may use it (Salesforce Help: OAuth 2.0 User-Agent Flow).

Custom apps built on the Salesforce Mobile SDK: web-server flow has been the default since Mobile SDK 11.0. Salesforce says:

Apps on an older SDK should upgrade as soon as possible, so users have time to install the updated app before the deadline.
Apps on 11.0+ that explicitly opted out of web-server flow must at least switch back. Salesforce recommends upgrading to the latest SDK (14.0.0). User-agent flow is deprecated in 14.0.0 and will be removed in 15.0.0.

Salesforce's own mobile apps (the Salesforce app, Mobile Publisher, Field Service and others) have already moved to web-server flow. Salesforce says end users should update them to the latest versions before 20 February 2027.

How to check your org

Option 1, the SOQL query (from KA 005461282; use the English values exactly):

SELECT Application
FROM LoginHistory
WHERE LoginSubType IN (
  'OAuth User-Agent',
  'OAuth User-Agent for Hybrid Apps',
  'OAuth User-Agent with ID Token'
)

Option 2, Login History in Setup. Add the Login Subtype column and look for the three values above.

Then look beyond the logs. Salesforce notes that Login History only shows recent use. It recommends also reviewing app configurations and deployment documentation so you don't miss an integration that hasn't run lately. As a general pointer (not from the KA), also search code and config for authorize requests that use response_type=token. Salesforce's user-agent flow docs use that value. Search for response_type=hybrid_token too, which the hybrid user-agent token flow docs use. The token id_token variant also belongs to the user-agent flow.

Block it in a sandbox to see what breaks. Turning off Allow OAuth User-Agent Flows in a sandbox blocks both flows (KA 005461282). Unauthenticated attempts don't appear in Login History, so watch application logs too.

What to do

From KA 005461282:

Identify integrations using either flow.
In a sandbox, migrate each one: - user-agent → web-server flow with PKCE - hybrid user-agent → hybrid web-server flow with PKCE
For apps you didn't build, confirm with the developer that an updated version will be ready before enforcement.
Turn off Allow OAuth User-Agent Flows in the sandbox and test until every integration works.
Copy the tested changes to production.

For mobile apps, start early. Salesforce's own advice is to upgrade soon "so that you get enough time for all your users to install the updated app" before the deadline. A fix only takes effect on devices that have installed the update.

The Release Update OAuth User-Agent and Hybrid User-Agent Flows Retirement in Setup has Salesforce's guided testing and activation steps. For the code side (adding the PKCE verifier and challenge, the token exchange and the errors to expect), the Connected App Retirement Kit has a user-agent to web server + PKCE runbook.

Timeline

Date	What happens	Source
Winter '27 release	Salesforce begins blocking the flows in newly created orgs	KA 005461282
Now to 20 Feb 2027	Existing integrations in older orgs keep working; test by turning off Allow OAuth User-Agent Flows in a sandbox	KA 005461282
20 Feb 2027	Final retirement in all orgs; no opt-out	KA 005461282, KA 005461287

FAQ

Which OAuth flow replaces the Salesforce user-agent flow?

The OAuth 2.0 web-server flow with the PKCE extension. For the hybrid user-agent flow, use the hybrid web-server flow with PKCE.

Why does the app fail in a new org but work in an older one?

Salesforce blocks these flows in newly created orgs starting with Winter '27. Older orgs can keep using them only until 20 February 2027.

Does turning off "Allow OAuth User-Agent Flows" block both flows?

Yes. It blocks the user-agent and hybrid user-agent flows, so you can test the retirement early.

The User-Agent Flow Disabled status is recorded only for authenticated users. Check application logs and failed /services/oauth2/authorize redirects as well.

Do Salesforce Mobile SDK apps need changes?

Apps on SDKs older than 11.0, or apps that opted out of web-server flow, do. Salesforce recommends upgrading to the latest Mobile SDK (14.0.0).

Sources

KA 005461282, Security Change: OAuth User-Agent Flow Retirement by February 20, 2027 (published Oct 19, 2026)
KA 005461287, Connected App & External Client App Security Requirement Updates (hub table, Oct 14, 2026)
Salesforce Help: OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration and OAuth 2.0 Hybrid User-Agent Token Flow for Web Session Management (response_type values)
Salesforce Developers: Mobile SDK Development Guide, OAuth 2.0 User-Agent Flow

Last checked: 29 October 2026, against the Salesforce pages above. If Salesforce's page and this article ever disagree, Salesforce's page is correct.

Checking more than one flow? The free 15-Minute Integration Auth Risk Check covers the user-agent, username-password, device and SOAP logins in one Login History pass, with no sign-up. It's also on the sfauthdeadline.com checklist section. For planning the migrations, the Connected App Retirement Kit has discovery queries, a decision tree and a user-agent to web server + PKCE runbook.

sfauthdeadline.com is an independent resource. It is not affiliated with, endorsed by or sponsored by Salesforce. Salesforce is a trademark of Salesforce, Inc.