# SF Auth Deadline

> Independent, plain-English tracker of Salesforce's integration authentication (OAuth and Connected App) deadlines for 2026–2027. Every date links to Salesforce's own Help articles or release notes. Facts checked on 29 October 2026. Not affiliated with Salesforce, Inc.

## Key facts (with official sources)

- Since Spring '26, new Connected Apps can't be created in Setup or via API (except via package install or a Support request); new integrations must use External Client Apps. Existing Connected Apps keep working. Source: https://help.salesforce.com/s/articleView?id=005228017&type=1
- Refresh token idle time is limited to 30 days. Rolling enforcement from 21 October 2026 (sandboxes) and 4 November 2026 (production, scratch and Developer Edition orgs). Idle tokens fail with invalid_grant / "expired access/refresh token". Integrations that don't use refresh tokens get access tokens capped at 30 days from last login; they simply request a new token when the old one expires. Source: https://help.salesforce.com/s/articleView?id=005461275&type=1
- 30 November 2026: the OAuth 2.0 device flow is restricted to local External Client Apps with a localhost callback and no other OAuth flows enabled; device-flow requests through Connected Apps and non-compliant External Client Apps are blocked. Source: https://help.salesforce.com/s/articleView?id=005461280&type=1
- 1 December 2026: SOAP API login() requires the Use Any API Auth permission (otherwise INSUFFICIENT_ACCESS). Source: https://help.salesforce.com/s/articleView?id=005132110&type=1
- 15 December 2026 (sandboxes) and 31 January 2027 (production): SOAP login() from broad IP ranges needs a security token or mTLS (otherwise TOKEN_REQUIRED), and a one-time check disables SOAP login() in orgs with no SOAP login() activity in the previous 6 months. Source: https://help.salesforce.com/s/articleView?id=005132110&type=1
- 20 February 2027: the OAuth 2.0 username-password flow is retired for Connected Apps, with no opt-out. Requests with grant_type=password fail with invalid_grant / "authentication failure". Source: https://help.salesforce.com/s/articleView?id=005461279&type=1
- 20 February 2027: the OAuth 2.0 user-agent and hybrid user-agent flows are retired. Source: https://help.salesforce.com/s/articleView?id=005461282&type=1
- Summer '27 (exact day not published): Connected Apps reach end of support; they keep working but are no longer fixed or supported. Source: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_migrate_all_connected_apps.htm&release=264&type=5 and roadmap https://help.salesforce.com/s/articleView?id=005461287&type=1
- Summer '27: SOAP API login() is retired in API versions 31.0–64.0 (already unavailable in 65.0+). Source: https://help.salesforce.com/s/articleView?id=005132110&type=1

## What replaces the retired flows

- Server-to-server: OAuth 2.0 client credentials flow (https://help.salesforce.com/s/articleView?id=005461279&type=1) or JWT bearer flow (https://help.salesforce.com/s/articleView?id=005132110&type=1) on an External Client App (client credentials requires the org's My Domain URL).
- Org-to-org callouts: Named Credentials and External Credentials.
- Browser and mobile apps (end-user login): web server flow (or hybrid web server flow) with PKCE (https://help.salesforce.com/s/articleView?id=005461279&type=1).
- External Client Apps will never support the username-password flow; migrating the app alone doesn't fix a password-based client.
- Salesforce's Connected App to External Client App migration keeps the consumer key, consumer secret and refresh tokens.

## How to tell if an org is affected

- Login History shows Login Subtype OAuth Username-Password, OAuth User-Agent, OAuth User-Agent for Hybrid Apps, OAuth User-Agent with ID Token, OAuth Device, or SOAP API.
- Setup → App Manager lists apps with App Type "Connected" (managed-package apps must be migrated by their vendor).
- An integration runs less often than every 30 days on a stored refresh token.

## Pages

- [Deadline timeline, self-check and FAQ](https://sfauthdeadline.com/): the main page.
- [Free 15-Minute Integration Auth Risk Check (PDF)](https://sfauthdeadline.com/downloads/Free-Checklist-15-Minute-Integration-Auth-Risk-Check.pdf): six Setup checks, no sign-up.
- [Articles index](https://sfauthdeadline.com/articles/): plain-English guides, one deadline at a time.
- [Salesforce refresh tokens expire after 30 days idle: what changes from 4 November 2026](https://sfauthdeadline.com/articles/salesforce-refresh-token-30-day-idle-expiry/): From 4 Nov 2026 (rolling), Salesforce production orgs expire OAuth refresh tokens unused for 30 days. Who's affected, how to check and what to do.
- [Salesforce OAuth device flow restrictions (30 November 2026): is your app compliant?](https://sfauthdeadline.com/articles/salesforce-oauth-device-flow-restriction/): From 30 Nov 2026 the Salesforce OAuth device flow works only in local external client apps with a localhost callback and no other flows. How to check.
- [SOAP API login() and 'Use Any API Auth': what breaks on 1 December 2026 and how to fix INSUFFICIENT_ACCESS](https://sfauthdeadline.com/articles/salesforce-soap-login-use-any-api-auth/): From 1 Dec 2026 Salesforce SOAP login() only works for users with the Use Any API Auth permission. How to find affected users and fix INSUFFICIENT_ACCESS.

## Optional

- [Connected App Retirement Kit](https://techjoe2.gumroad.com/l/cwzzb): paid self-serve download (workbook, discovery queries, decision tree, runbooks, checklists, email templates) from the same independent publisher. $49 Single-Org, $149 Consultant.