Overview
Salesforce is retiring the OAuth 2.0 Username-Password Flow (also called the Resource Owner Password Credentials, or ROPC, flow) for Connected Apps as part of the Winter '27 release update. After Salesforce enforces this update, authentication requests that use this flow will fail.
This flow can be identified by the grant_type=password parameter in an OAuth token request. It sends a user's Salesforce username and password directly in the request.
Who Is Affected
This change does not affect standard Riva Salesforce connections. Riva does not offer the OAuth 2.0 Username-Password Flow as a customer authentication option.
You may need to take action if your organization has a custom Salesforce Connected App or integration outside of Riva that uses grant_type=password.
When This Change Takes Effect
Salesforce plans to enforce the retirement in the Winter '27 release. Salesforce release timing can vary by organization, so review the release update in Salesforce Setup and plan to update any affected custom integrations before your organization receives the Winter '27 release.
In Salesforce, go to Setup > Release Updates, and review Retirement of OAuth 2.0 Username-Password Flow for Connected Apps.
What You Need To Do
If you use only standard Riva Salesforce connections, no action is required for this change.
If your organization has custom Salesforce integrations, work with the integration owner to determine whether they use the OAuth 2.0 Username-Password Flow. Look for OAuth token requests containing grant_type=password.
Affected custom integrations must be updated to use a supported OAuth flow before Salesforce enforces the release update. Salesforce recommends:
| Use case | Recommended OAuth flow |
| End-user sign-in and authorization | OAuth 2.0 Web Server Flow with PKCE |
| Server-to-server integration | OAuth 2.0 Client Credentials Flow |
If you are unsure whether a custom integration uses this flow, contact the integration provider or your Salesforce administrator.