Overview
Salesforce is introducing several OAuth and SOAP API authentication changes throughout 2026 and 2027 to improve authentication security and retire legacy authentication methods.
This article tracks these announcements, their enforcement dates, their impact on Riva, and any actions customers may need to take.
Summary of announced changes
| Salesforce Announcement | Enforcement Date | Riva Impact |
|---|---|---|
| Refresh Token Idle TTL Limited to 30 Days | October 21, 2026 (Sandbox), November 4, 2026 (Production) | Low risk for regularly active integrations |
| OAuth 2.0 Device Flow Restrictions | November 30, 2026 | No impact |
| Retirement of OAuth 2.0 Username-Password Flow | Winter '27 | No impact to standard Riva connections |
SOAP API login() Security Requirements and Retirement |
Security requirements: December 2026-January 2027 Retirement: Summer ’27 |
Action required for legacy Riva On-Premise username/password connections |
Each section below provides details about the specific announcement, its impact, and recommended next steps.
1. Refresh Token Idle TTL Limited to 30 Days
Overview
Salesforce will enforce a maximum 30-day idle timeout for OAuth refresh tokens.
If a refresh token remains unused for more than 30 days, Salesforce will revoke it. Once revoked, the integration must be reauthorized to restore access.
Who Is Affected
Connected Apps and integrations that use OAuth refresh tokens and may remain inactive for extended periods.
Riva Impact: Low
Riva integrations typically operate continuously, communicating with Salesforce regularly to synchronize information.
This change is not expected to disrupt normally operating Riva integrations, provided their refresh tokens are used within the 30-day window.
Potential scenarios to be aware of include:
- Integrations paused or disabled for more than 30 days.
- Infrequently used sandbox or test environments.
- Integrations that do not use their refresh tokens for extended periods.
When This Change Takes Effect
- October 21, 2026: Sandbox environments
- November 4, 2026: Production environments
Connected Apps created on or after July 9, 2026 already have this requirement enforced.
What You Need To Do
For most Riva customers, no action is expected.
If a Riva integration has been inactive for more than 30 days and its refresh token has been revoked, reauthorization may be required to restore connectivity.
Note: The 30-day limit applies specifically to refresh token usage, not general API activity. Riva Engineering is validating refresh token behavior across supported authentication configurations.
Additional Information
- Salesforce Release Note: Refresh Token Idle TTL Limited to 30 Days
- Salesforce Knowledge Article: Refresh Token Idle TTL Requirements
2. OAuth 2.0 Device Flow Restrictions
Overview
Salesforce is restricting OAuth 2.0 Device Flow authentication to local External Client Apps (ECAs) using a localhost callback URL.
Connected Apps using this authentication flow must migrate to supported External Client Apps to maintain authentication functionality.
Who Is Affected
Applications and integrations that use OAuth 2.0 Device Flow for Salesforce authentication.
Riva Impact: None
Riva does not use OAuth 2.0 Device Flow for Salesforce authentication.
This change does not affect standard Riva Salesforce connections.
When This Change Takes Effect
November 30, 2026: All Salesforce environments.
What You Need To Do
No action is required for Riva customers.
Organizations using custom integrations outside of Riva that rely on OAuth 2.0 Device Flow should review Salesforce's requirements and update those integrations as necessary.
Additional Information
- Salesforce Release Note: OAuth 2.0 Device Flow Restrictions
- Salesforce Knowledge Article: Legacy OAuth Flow Restrictions and Retirements
3. Retirement of OAuth 2.0 Username-Password Flow for Connected Apps
Overview
Salesforce is retiring the OAuth 2.0 Username-Password Flow, also known as the Resource Owner Password Credentials (ROPC) flow, as part of the Winter '27 release.
After enforcement, authentication requests using this flow will fail.
This authentication method can be identified by the grant_type=password parameter in OAuth token requests.
Who Is Affected
Organizations using custom Salesforce Connected Apps or integrations that rely on the OAuth 2.0 Username-Password Flow.
Riva Impact: None
Standard Riva Salesforce connections are not affected.
Riva does not offer the OAuth 2.0 Username-Password Flow as a customer authentication option.
When This Change Takes Effect
February 20, 2027
Customers can review the enforcement status under Salesforce Setup > Release Updates.
What You Need To Do
No action is required for customers using standard Riva Salesforce connections.
Customers with custom integrations outside of Riva should review whether those integrations use grant_type=password and migrate affected integrations to supported authentication flows.
For detailed guidance, recommended OAuth alternatives, and next steps, refer to our existing knowledge base article below.
Additional Information
- Riva Knowledge Base: Salesforce Retirement of the OAuth 2.0 Username-Password Flow for Connected Apps
- Salesforce Release Update: Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)
4. SOAP API login() Security Requirements and Retirement
Overview
Salesforce is retiring the SOAP API login() method in API versions 31.0 through 64.0 with the Summer ’27 release. The method is already unavailable in API versions 65.0 and later.
Salesforce is also introducing security requirements before retirement that can prevent existing SOAP logins from succeeding.
Note: This retirement is separate from the OAuth 2.0 Username-Password Flow retirement described in section 3. It affects the SOAP API login() authentication method, rather than all SOAP API operations.
Who Is Affected
Applications and integrations that authenticate through SOAP API login(), including legacy Riva On-Premise and Riva Cloud Salesforce connections configured with username/password authentication.
Riva Impact: Action required for legacy username/password connections
Riva Salesforce connections configured with OAuth are unaffected by this retirement.
Starting with Riva On-Premise 2026.3, creating new Salesforce username/password connections through the Riva App UI is disabled. Existing username/password connections are deprecated and display a deprecation message.
When This Change Takes Effect
| Enforcement Date | Change |
|---|---|
| December 1, 2026 | Users authenticating through SOAP API login() must have the Use Any API Auth permission. |
|
December 15, 2026 - Sandbox January 31, 2027 - Production |
Broad login IP ranges require a security token or mutual TLS for SOAP login. A separate one-time check disables SOAP login in organizations with no SOAP login activity during the preceding six months. |
| Summer ’27 | SOAP API login() stops working in API versions 31.0–64.0. |
What You Need To Do
Customers using legacy Salesforce username/password connections in Riva On-Premise or Riva Cloud should migrate to OAuth before the applicable security requirements take effect.
Until migration is complete, work with your Salesforce administrator to review the requirements above. Meeting these interim requirements does not remove the need to migrate before Summer ’27.
For migration guidance, see Salesforce Username/Password Authentication Deprecation for Riva On-Premise.
If you need assistance reviewing your Riva connection, contact the Riva Support Team.
Additional Information
- Salesforce: Platform SOAP API
login()Retirement & New Security Requirements - Riva 2026.3 Cloud and On-Premise Release
This article will be updated as Salesforce announces additional authentication security requirements or changes to existing enforcement timelines.