Tomorrow, October 21, 2026, Salesforce starts rolling out security updates to how your integrations work.

It has been a while, and I had already started worrying they'd figured out we have actual features to build. No reason to worry, though: they did not forget, and here we are again.

Over the coming weeks and months, Salesforce will be tightening the rules for integrations across sandbox and production environments to deliver a few improvements:

  • Refresh tokens expire after 30 days without use, in sandboxes starting October 21 and in production starting November 4.
  • The OAuth device flow works only from local External Client Apps with a localhost callback, starting November 30.
  • The username-password, user-agent and hybrid user-agent flows are retired on February 20, 2027.

If you have received the email and do not know where to start, I put together a detailed guide on what this is about and what you should look for: https://www.bulkifiedthinking.com/salesforce-is-changing-how-integrations-log-in/

If you have any questions or insights, do not hesitate to leave a comment, and I will try to elaborate, correct or help you on this journey!

Salesforce Updates