# SF Auth Deadline

> Independent, plain-English tracker of Salesforce's integration authentication (OAuth and Connected App) deadlines for 2026–2027. Every date links to Salesforce's own Help articles or release notes. Facts checked on 28 October 2026. Not affiliated with Salesforce, Inc.

## Key facts (with official sources)

- Since Spring '26, new Connected Apps can't be created in the UI or through APIs (package installation excepted); new integrations must use External Client Apps. Existing Connected Apps keep working. Source: https://help.salesforce.com/s/articleView?id=005228017&type=1
- Refresh token idle time is limited to 30 days. Rolling enforcement from 21 October 2026 (sandboxes) and 4 November 2026 (production, scratch and Developer Edition orgs). Idle tokens fail with invalid_grant / "expired access/refresh token". Source: https://help.salesforce.com/s/articleView?id=005461275&type=1
- 30 November 2026: the OAuth 2.0 device flow is restricted to local External Client Apps with a localhost callback and no other OAuth flows enabled. Source: https://help.salesforce.com/s/articleView?id=005461280&type=1
- 1 December 2026: SOAP API login() requires the Use Any API Auth permission (otherwise INSUFFICIENT_ACCESS). Source: https://help.salesforce.com/s/articleView?id=005132110&type=1
- 15 December 2026 (sandboxes) and 31 January 2027 (production): SOAP login() from broad IP ranges needs a security token or mTLS (otherwise TOKEN_REQUIRED), and a one-time check disables SOAP login() in orgs with no SOAP login() activity in the previous 6 months. Source: https://help.salesforce.com/s/articleView?id=005132110&type=1
- 20 February 2027: the OAuth 2.0 username-password flow is retired for Connected Apps, with no opt-out. Requests with grant_type=password fail with invalid_grant / "authentication failure". Source: https://help.salesforce.com/s/articleView?id=005461279&type=1
- 20 February 2027: the OAuth 2.0 user-agent and hybrid user-agent flows are retired. Source: https://help.salesforce.com/s/articleView?id=005461282&type=1
- Summer '27 (exact day not published): Connected Apps reach end of support; they keep working but are no longer fixed or supported. Source: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_migrate_all_connected_apps.htm&release=264&type=5 and roadmap https://help.salesforce.com/s/articleView?id=005461287&type=1
- Summer '27: SOAP API login() is retired in API versions 31.0–64.0 (already unavailable in 65.0+). Source: https://help.salesforce.com/s/articleView?id=005132110&type=1

## What replaces the retired flows

- Server-to-server: OAuth 2.0 JWT bearer flow or client credentials flow on an External Client App (client credentials requires the org's My Domain URL).
- Org-to-org callouts: Named Credentials and External Credentials.
- Browser and mobile apps: web server flow (or hybrid web server flow) with PKCE.
- External Client Apps will never support the username-password flow; migrating the app alone doesn't fix a password-based client.
- Salesforce's Connected App to External Client App migration keeps the consumer key, consumer secret and refresh tokens.

## How to tell if an org is affected

- Login History shows Login Subtype OAuth Username-Password, OAuth User-Agent, OAuth User-Agent for Hybrid Apps, OAuth User-Agent with ID Token, OAuth Device, or SOAP API.
- Setup → App Manager lists apps with App Type "Connected" (managed-package apps must be migrated by their vendor).
- An integration runs less often than every 30 days on a stored refresh token.

## Pages

- [Deadline timeline, self-check and FAQ](https://sfauthdeadline.com/): the main page.
- [Free 15-Minute Integration Auth Risk Check (PDF)](https://sfauthdeadline.com/downloads/Free-Checklist-15-Minute-Integration-Auth-Risk-Check.pdf): six Setup checks, no sign-up.

## Optional

- [Connected App Retirement Kit](https://techjoe2.gumroad.com/l/cwzzb): paid self-serve download (workbook, discovery queries, decision tree, runbooks, checklists, email templates) from the same independent publisher. $49 Single-Org, $149 Consultant.