Overview
Salesforce is introducing several OAuth security changes throughout 2026 and the Winter '27 release to improve authentication security and retire legacy authentication methods.
This article tracks these announcements, their enforcement dates, their impact on Riva, and any actions customers may need to take.
Summary of announced changes
| Salesforce Announcement | Enforcement Date | Riva Impact |
|---|---|---|
| Refresh Token Idle TTL Limited to 30 Days | October 21, 2026 (Sandbox), November 4, 2026 (Production) | Low risk for regularly active integrations |
| OAuth 2.0 Device Flow Restrictions | November 30, 2026 | No impact |
| Retirement of OAuth 2.0 Username-Password Flow | Winter '27 | No impact to standard Riva connections |
Each section below provides details about the specific announcement, its impact, and recommended next steps.
1. Refresh Token Idle TTL Limited to 30 Days
Overview
Salesforce will enforce a maximum 30-day idle timeout for OAuth refresh tokens.
If a refresh token remains unused for more than 30 days, Salesforce will revoke it. Once revoked, the integration must be reauthorized to restore access.
Who Is Affected
Connected Apps and integrations that use OAuth refresh tokens and may remain inactive for extended periods.
Riva Impact: Low
Riva integrations typically operate continuously, communicating with Salesforce regularly to synchronize information.
This change is not expected to disrupt normally operating Riva integrations, provided their refresh tokens are used within the 30-day window.
Potential scenarios to be aware of include:
- Integrations paused or disabled for more than 30 days.
- Infrequently used sandbox or test environments.
- Integrations that do not use their refresh tokens for extended periods.
When This Change Takes Effect
- October 21, 2026: Sandbox environments
- November 4, 2026: Production environments
Connected Apps created on or after July 9, 2026 already have this requirement enforced.
What You Need To Do
For most Riva customers, no action is expected.
If a Riva integration has been inactive for more than 30 days and its refresh token has been revoked, reauthorization may be required to restore connectivity.
Note: The 30-day limit applies specifically to refresh token usage, not general API activity. Riva Engineering is validating refresh token behavior across supported authentication configurations.
Additional Information
- Salesforce Release Note: Refresh Token Idle TTL Limited to 30 Days
- Salesforce Knowledge Article: Refresh Token Idle TTL Requirements
2. OAuth 2.0 Device Flow Restrictions
Overview
Salesforce is restricting OAuth 2.0 Device Flow authentication to local External Client Apps (ECAs) using a localhost callback URL.
Connected Apps using this authentication flow must migrate to supported External Client Apps to maintain authentication functionality.
Who Is Affected
Applications and integrations that use OAuth 2.0 Device Flow for Salesforce authentication.
Riva Impact: None
Riva does not use OAuth 2.0 Device Flow for Salesforce authentication.
This change does not affect standard Riva Salesforce connections.
When This Change Takes Effect
November 30, 2026: All Salesforce environments.
What You Need To Do
No action is required for Riva customers.
Organizations using custom integrations outside of Riva that rely on OAuth 2.0 Device Flow should review Salesforce's requirements and update those integrations as necessary.
Additional Information
- Salesforce Release Note: OAuth 2.0 Device Flow Restrictions
- Salesforce Knowledge Article: Legacy OAuth Flow Restrictions and Retirements
3. Retirement of OAuth 2.0 Username-Password Flow for Connected Apps
Overview
Salesforce is retiring the OAuth 2.0 Username-Password Flow, also known as the Resource Owner Password Credentials (ROPC) flow, as part of the Winter '27 release.
After enforcement, authentication requests using this flow will fail.
This authentication method can be identified by the grant_type=password parameter in OAuth token requests.
Who Is Affected
Organizations using custom Salesforce Connected Apps or integrations that rely on the OAuth 2.0 Username-Password Flow.
Riva Impact: None
Standard Riva Salesforce connections are not affected.
Riva does not offer the OAuth 2.0 Username-Password Flow as a customer authentication option.
When This Change Takes Effect
Winter '27 Salesforce Release
Release timing may vary by Salesforce organization.
Customers can review the enforcement status under Salesforce Setup > Release Updates.
What You Need To Do
No action is required for customers using standard Riva Salesforce connections.
Customers with custom integrations outside of Riva should review whether those integrations use grant_type=password and migrate affected integrations to supported authentication flows.
For detailed guidance, recommended OAuth alternatives, and next steps, refer to our existing knowledge base article:
Salesforce Retirement of the OAuth 2.0 Username-Password Flow for Connected Apps
Additional Information
- Salesforce Release Update: Retirement of OAuth 2.0 Username-Password Flow for Connected Apps
- Riva Knowledge Base: Salesforce Retirement of the OAuth 2.0 Username-Password Flow for Connected Apps (linked above)
This article will be updated as Salesforce announces additional OAuth security requirements or changes to existing enforcement timelines.