Salesforce Retirement of OAuth 2.0 Username-Password Flow and Impact on Own from Salesforce Products

Salesforce will stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow.

This update improves security and better protects your Salesforce data. The username-password flow directly passes the user's credentials in HTTP requests, which presents security risks.

All connected app integrations that use the username-password flow will no longer work. Salesforce recommends updating your integrations to use a more secure flow. For end user login and authorization, use the OAuth 2.0 web-server flow with the Proof Key for Code Exchange (PKCE) extension, which adds a dynamically generated secret to each login request to prevent interception. For server-to-server integrations, use the OAuth 2.0 client credentials flow.

Own from Salesforce will implement these changes to ensure the highest level of trust and protection for our customers. Our Engineering team is already actively working on a solution to ensure we are fully compliant before the enforcement deadlines. To meet these requirements, Engineering is transitioning our authentication flow from traditional refresh tokens to a JWT-based (JSON Web Token) architecture with full PKCE support.