Salesforce Connected Apps & ECA Security Controls Post-Enforcement Guidance for Partners

Please follow these steps immediately to restore connectivity:

1. Update your application: Implement the following technical changes associated with the controls.

   • PKCE: Update your app code to generate and send code_verifier and code_challenge.

   • Refresh Token Rotation (RTR): Implement logic to capture the new refresh token issued after every refresh token call. Handle potential race conditions in your client application.

   • Refresh Token Idle TTL (30 Days): Ensure your application invokes the refresh token flow well before the 30-day expiration mark.

   • Refresh Token IP Allowlist: Ensure your application uses static, publicly routable IP addresses. Add trusted egress IPs to the Refresh Token IP allowlist configuration.

2. Validate the Changes: Verify via Parallel ECAs.

   • You cannot de-activate/activate controls on your production Connected App or ECA to test them.

   • Create a parallel External Client App (ECA) in a sandbox or scratch org to verify your code changes using the client ID and client secret before deploying to production.

   • Using a parallel ECA will allow you to activate and de-activate the controls, test and validate the code changes.

3. Deploy to Production: Deploy client code changes to production.

   • After thorough verification of the controls and code changes using a parallel ECA, deploy the code changes to production

   • Associate the code changes with your production Connected / ECA configuration.

   • NOTE: Some integrations MAY require customers to re-authorize the app if the access token / refresh token have expired.

   • Once validated, deploy the updated non-Salesforce applications to your customers immediately. Ensure you use the production CA/ECA’s client key/secret instead of the parallel ECA used for sandbox verification.

4. Take applicable customer actions: Potential non-Salesforce apps / Apex code as Connected app client use cases

   • If the client is a non-Salesforce app (mobile, desktop, browser plugin, etc), customers may need to upgrade to the latest version of the non-Salesforce app for interoperation to be restored.

     • For example: PKCE changes to the client will require mobile app upgrades by customers.

   • Where OAuth flow is initiated by Apex, this will require the customers to upgrade to the latest version of the managed package.

Please review the CA/ECA Security Controls page on the ISVForce Guide and the Partner App FAQs for up to date information on the new security controls and technical details. For notifications about updates, please join the Partnerblazer Slack channel. Please stay in contact with your PAM for updates. If you do not have a PAM, email partnercommunitysupport@salesforce.com.