Default Salesforce CLI OAuth 2.0 Device Flow Removal

Recommended Alternative Flows

[1] Web Server Flow

Use the Web Server Flow for interactive authentication with browser access:

• CLI command: sf org login web
• Documentation: Authorize an Org Using a Browser
  
  

[2] JWT Bearer Flow

Use the JWT (JSON Web Token) Bearer Flow for headless environments such as CI/CD pipelines where browser authentication is not available:

• CLI command: sf org login jwt
• Documentation: Authorize an Org in a Headless Environment (JWT)
  
  

Important Note:

You cannot work around this restriction by re-enabling the Device Flow in a custom connected app, because the Enable for Device Flow option in the API (Enable OAuth Settings) section has been permanently disabled by Salesforce. Additionally, Org Admins must now install the Salesforce CLI connected app themselves — this can no longer be done by standard users.