Salesforce PKCE Impact on Riva Sync On-Premises

Applies to	Customer-managed Riva Sync On-Premises deployments that use Salesforce OAuth
Topic	Salesforce Proof Key for Code Exchange (PKCE)
Last reviewed	September 16, 2026
Audience	Riva administrators, support teams, and Salesforce administrators

Summary

Salesforce PKCE changes the OAuth authorization process, not Riva synchronization logic. For Riva Sync On-Premises, customers manage the Riva release, the Salesforce Connected App or External Client App, and the production rollout. Riva has implemented PKCE support in the affected Salesforce OAuth connection flows; however, customers must validate their own Riva deployment and OAuth flow before enforcing PKCE.

Overview

This article is for Riva Sync On-Premises deployments. In an on-premises deployment, the customer is responsible for the Riva server or servers, the Salesforce app configuration, and any network controls that affect the connection.

Proof Key for Code Exchange (PKCE) is an OAuth 2.0 extension that binds an authorization request to the client that completes the token exchange. In supported authorization-code flows, the client sends a code_challenge when requesting authorization and the matching code_verifier when exchanging the authorization code for a token.

Salesforce can require PKCE for individual Connected Apps or External Client Apps, and an organization-wide setting can block authorization-code flow variations that do not use PKCE. Salesforce states that PKCE is required for ISV Salesforce client apps using applicable flows.

Key point

PKCE does not change how Riva Sync processes Calendar, Contacts, Tasks, or Email after Salesforce authentication succeeds.

Impact on Riva Sync

For Riva Sync On-Premises, PKCE affects the Salesforce authentication layer. It does not directly change synchronization rules, matching behavior, polling, conflict handling, or module behavior. The Riva server must be running a release that includes the current Salesforce OAuth support before the Salesforce control is enforced.

Creating a new Salesforce connection exercises the PKCE-capable authorization flow.
Revalidating an existing connection exercises the PKCE-capable authorization flow.
Revoking OAuth tokens, changing the Salesforce app, or otherwise requiring a new authorization flow also makes PKCE relevant.
An already authenticated connection is not, by itself, evidence that a new authorization exchange will succeed after PKCE is enforced.

If an affected OAuth client does not perform the required PKCE exchange and Salesforce requires PKCE, authentication or reauthentication fails before normal synchronization can proceed.

When PKCE is most likely to affect Riva

Scenario	Expected impact
Existing connection with valid tokens	No direct sync behavior change is expected solely because PKCE is enabled. Validate reauthorization separately.
New Salesforce connection	The authorization exchange must use PKCE when the Salesforce configuration requires it.
Reauthentication	The authorization-code exchange must use PKCE when required.
Token revocation or app change	A new authorization flow may be required, making PKCE compatibility relevant.
Successful PKCE authentication	Riva Sync functionality should behave as before unless another configuration issue exists.

PKCE and other Salesforce OAuth controls

PKCE is separate from other Salesforce OAuth controls, such as Refresh Token Rotation, refresh-token IP allow lists, and retirement or restriction of individual OAuth flows. Assess each control independently against the OAuth flow used by the on-premises Riva deployment.

For Riva On-Premises, the current preparation guidance describes a Client Credentials configuration and specifies that the PKCE option is not selected. This is consistent with the scope of PKCE: Client Credentials is not an authorization-code flow. Do not apply that instruction to a separate authorization-code connection without confirming the flow and configuration first.

Recommended validation procedure

Identify the Salesforce Connected App or External Client App used by the on-premises Riva Sync deployment.
Identify the Riva server, RAS instance, and Sync nodes that use the Salesforce connection.
Record the Riva Sync version and build in use, and confirm that it includes current Salesforce OAuth support.
Perform the change in a Salesforce sandbox or UAT environment before production.
Enable the intended PKCE requirement in Salesforce.
Reauthenticate the Salesforce connection. Do not rely only on an already-authenticated connection.
Create a new test Salesforce connection, where practical, to exercise the full authorization process.
Validate synchronization initialization and the enabled Calendar, Contacts, Tasks, and Email modules.
Review Riva and Salesforce authentication logs for authorization or token-exchange errors.

Troubleshooting guidance

Authentication fails after PKCE is required

Confirm whether the failure occurs during initial authorization or token exchange.
Confirm the OAuth flow used by the affected Riva component.
Confirm that PKCE is enabled only for the intended supported authorization-code flows.
Capture the exact Salesforce OAuth error and Riva connection log before changing other configuration.

Existing sync works, but reauthentication fails

This pattern indicates that a new authorization exchange needs validation. Confirm the OAuth flow and the Salesforce app configuration, then collect the Salesforce OAuth error and Riva connection log for Support.

Sync module errors occur after authentication succeeds

If Salesforce authentication completes successfully and only specific Calendar, Contact, Email, or Task operations fail, investigate those errors separately. PKCE controls the authorization exchange and should not selectively change normal CRM synchronization logic after a valid token is obtained.

Support position

Salesforce PKCE is an authentication compatibility change for Riva Sync On-Premises. It is not expected to change Riva Sync functionality after Salesforce authentication succeeds. Riva has implemented support for PKCE in affected Salesforce OAuth flows. Before enforcing PKCE in production, validate connection creation and reauthentication on the customer’s Riva server or servers and with the OAuth flow that the deployment actually uses.