Skip to main content
New tool CRON Expression Builder — preview next run times before you schedule Apex. Open the builder →

OAuth articles

16 articles · Connected apps, the OAuth flows, and token handling.

Diagram showing Salesforce refresh token expiration after 30 idle days causing an invalid_grant errorIntegration

Salesforce Refresh Token Expiration: 30-Day Idle Fix

Salesforce now expires any OAuth refresh token left unused for 30 days, and enforcement began rolling out to production...

· 11 min readDiagram of Salesforce instanced URL enforcement blocking API calls sent to hardcoded instance hostsIntegration

Salesforce Instanced URL Enforcement: Remove Hardcoded Hosts

Salesforce instanced URL enforcement already blocks sandbox API calls sent to the wrong instance host, and production...

· 11 min readDiagram of OAuth user-agent flow retirement and migration to the Web Server flow with PKCEIntegration

OAuth User-Agent Flow Retirement: Move to Web Server + PKCE

On February 20, 2027 Salesforce stops issuing tokens through the user-agent and hybrid user-agent flows, which SPAs,...

· 10 min readDiagram of an OAuth username-password flow retirement migration to Client Credentials and JWT BearerIntegration

OAuth Username-Password Flow Retirement: Migrate by Feb 20

Salesforce blocks new tokens from the OAuth username-password flow on February 20, 2027, and affected integrations fail...

· 10 min readMigration tracker sorting apps into four ownership buckets ahead of connected apps end of supportIntegration

Connected Apps End of Support: What to Migrate and When

Connected apps end of support lands in Summer '27 for every app in your org, and device-flow apps face an earlier...

· 9 min readTimeline diagram of the Salesforce SOAP login retirement with Winter '27 and Summer '27 deadlinesIntegration

Salesforce SOAP Login Retirement: Two Deadlines, One Audit

Salesforce SOAP login retirement starts in Winter '27, when login() requires the Use Any API Auth permission, and...

· 9 min read
Salesforce OAuth device flow moving from a connected app to a local External Client AppIntegration

Salesforce OAuth Device Flow Ends for Connected Apps Nov 30

From 30 November 2026 the OAuth 2.0 device flow only works from local External Client Apps with a localhost callback,...

· 10 min readDiagram of a Salesforce webhook integration using JWT Bearer Flow through a Node.js serviceIntegration

Salesforce Webhook Integration With JWT Bearer Flow

Salesforce has no inbound webhook listener, so third-party callbacks need a small service in front of the org. Building...

· 11 min readA digital padlock representing the unsupported_grant_type Apigee error resolution for secure Salesforce API integrations.Integration

unsupported_grant_type: Fixing Apigee JWT Integration

The unsupported_grant_type error in Apigee usually comes down to how the OAuthV2 policy reads request headers against...

· 3 min readA 3D rendering showing the Box.com Salesforce integration concept with cloud and folder icons.Apex

Box.com Salesforce Integration: Apex Backend Guide

How to wire Salesforce up to Box.com in Apex: secure authentication, the file upload patterns that hold up, and error...

· 3 min readAn illustration representing secure OAuth 2.0 JWT Bearer flow connectivity for Salesforce integration.Integration

External Client App for Headless 360 MCP: Scopes and Setup

Headless 360's MCP server needs an External Client App with the mcp_api scope, refresh_token, and API v67.0 or later....

· 10 min readDiagram showing the process for unattended Salesforce sandbox user token generation in a CI/CD flowIntegration

Unattended Sandbox User Token Generation for CI/CD

Pulling access tokens for a pile of sandbox test users is a common CI/CD snag when the tests have to run as specific...

· 4 min read