Loading
Prepare for Email to Become the Default Login ExperienceRead More
Secure Your Salesforce Org
Multi-Factor Authentication for API Access

You are here:

  1. Salesforce Help
  2. Docs
  3. Secure Your Salesforce Org

Multi-Factor Authentication for API Access

Salesforce doesn't require multi-factor authentication (MFA) for integration login types via the API. But you can add extra protection for API access with the Multi-Factor Authentication for API Logins permission. With this permission, you require users to complete a second authentication challenge to access Salesforce APIs. API access includes the use of client apps such as the Data Loader and connected apps.

Required Editions

Available in: both Salesforce Classic and Lightning Experience
Available in: all editions
User Permissions Needed
To edit system permissions in profiles: Manage Profiles and Permission Sets
To turn on this feature:

Multi-Factor Authentication for User Interface Logins

AND

Multi-Factor Authentication for API Logins
Important
Important

Salesforce enforces MFA requirements in the summer of 2026. MFA enforcement can affect integrations that use UI logins. To resolve any integration issues, see Troubleshoot Integration or API User Account Login Issues After MFA Enforcement.

For more information about MFA enforcement, including detailed rollout timelines, see these knowledge articles:

The Multi-Factor Authentication for User Interface Logins permission is a prerequisite for the Multi-Factor Authentication for API Logins permission. Before the Multi-Factor Authentication for API Logins permission takes effect, users must access Salesforce through the UI and complete MFA by using Salesforce Authenticator or a one-time password app. After users have completed MFA through the UI, they can use time-based, one-time passwords (TOTPs) generated by their authenticator app for API logins.

Note
Note You can’t assign the Multi-Factor Authentication for User Interface Logins permission to users with the Salesforce Limited Access — Free license. We're working to resolve this issue.

For developer tools that use API logins, users log in with a security token or TOTP instead of Salesforce Authenticator when MFA is enabled.

Note
Note API Only users can access the UI to register for MFA only. After a successful registration, API Only users can no longer access the UI.

For connected apps, only these standard OAuth 2.0 flows support API logins with the high-assurance MFA session security level.

  • Web server flow
  • Refresh token flow
  • User-agent flow
  • JSON Web Token (JWT) bearer flow

All other standard OAuth 2.0 flows block API logins with the high-assurance MFA session security level.

Salesforce can prompt users to verify their identity twice with high-assurance MFA during an OAuth approval flow. The first challenge occurs in the UI session. The second challenge occurs when the client app bridges the access token into the UI. This second challenge happens because Salesforce doesn't transfer the high-assurance MFA session security level to the access token. For more information, see Session Security Levels.

See Also

 
Loading
Salesforce Help | Article