> ## Content Index > Fetch the complete content index at: https://www.bulkifiedthinking.com/llms.txt > Use this file to discover other available public pages before exploring further. # Salesforce OAuth Is Changing, Again 👋 - URL: https://www.bulkifiedthinking.com/posts/salesforce-oauth-is-changing-again/ - Published: 2026-10-20T04:11:34.000Z - Updated: 2026-10-20T04:11:34.000Z - Description: Refresh tokens that expire, a device flow that only works with localhost and a password flow that disappears. This guide covers the upcoming Salesforce OAuth changes, how to find the affected integrations in your org and how to fix them before they land. - Author: Andrii Sukhetskyi - Tags: #posts, #beaware, Salesforce Updates Tomorrow, October 21, 2026, Salesforce starts rolling out security updates to how your integrations work. It has been a while, and I had already started worrying they'd figured out we have actual features to build. No reason to worry, though: they did not forget, and here we are again. Over the coming weeks and months, Salesforce will be tightening the rules for integrations across sandbox and production environments to deliver a few improvements: - Refresh tokens expire after 30 days without use, in sandboxes starting October 21 and in production starting November 4. - The OAuth device flow works only from local External Client Apps with a localhost callback, starting November 30. - The username-password, user-agent and hybrid user-agent flows are retired on February 20, 2027. If you have received the email and do not know where to start, I put together a detailed guide on what this is about and what you should look for: If you have any questions or insights, do not hesitate to leave a comment, and I will try to elaborate, correct or help you on this journey!