<turbo-stream action="update" target="wiki_card"><template>

<h1>Salesforce Connected App Security Updates 2026-2027: Impact on Rapidi</h1>
<div class="trix-content"><div><strong>Overview<br></strong><br></div><div>Rapidi is already compliant with three of the four changes in Salesforce's Connected App and External Client App security update. The fourth, the 30-day refresh token idle limit, affects a specific class of connection: those that sit idle for more than 30 days get revoked and need a manual re-authorization.<br><br></div><div>If you received the Salesforce "Connected App &amp; External Client App Security Requirement Update" email and use Rapidi to sync Salesforce, this page explains what it means for you.<br><br></div><div><strong>The changes at a glance<br></strong><br></div><table border="1" cellpadding="6"><thead><tr>Salesforce changeEnforcement dateImpact on Rapidi</tr></thead><tbody><tr><td>Refresh token idle limit of 30 days</td><td>21 Oct 2026 (sandboxes), 4 Nov 2026 (production)</td><td>Affects only connections idle for more than 30 days. See below.</td></tr><tr><td>OAuth 2.0 device flow restricted to local External Client Apps</td><td>30 Nov 2026 (all environments)</td><td>Not affected. Rapidi does not use the device flow.</td></tr><tr><td>OAuth 2.0 username-password flow retirement</td><td>20 Feb 2027 (all environments)</td><td>Not affected. Rapidi does not use this OAuth flow.</td></tr><tr><td>OAuth 2.0 user-agent and hybrid user-agent flows retirement</td><td>20 Feb 2027 (all environments)</td><td>Not affected. Rapidi does not use these flows.</td></tr></tbody></table><div><br>The full list of changes is on Salesforce's Connected App &amp; External Client App Security Requirement Updates page, which links to a release note or knowledge article for each change.<br><br></div><div><strong>How Rapidi connects to Salesforce<br></strong><br></div><div>Rapidi's Salesforce connector authorizes with the OAuth 2.0 web server flow and uses exactly one OAuth grant: the refresh token grant.<br><br></div><ul><li><strong>Authorization:</strong> web server flow (response_type=code). Salesforce Login History records it as OAuth-Webserver.</li><li><strong>OAuth grant:</strong> grant_type=refresh_token, and nothing else.</li><li><strong>Not used:</strong> the device flow, the user-agent and hybrid user-agent flows, and the OAuth username-password flow.</li></ul><div>This is why the three flow retirements require no action from Rapidi customers.<br><br></div><div><strong>The 30-day refresh token idle limit<br></strong><br></div><div>Salesforce will revoke a refresh token that goes unused for more than 30 days. A connection whose refresh token is revoked needs a manual re-authorization.<br><br></div><div>Rapidi refreshes the token whenever a transfer runs and the cached access token is older than 6000 seconds. So any connection that runs at least monthly keeps its token alive and is unaffected.<br><br></div><div><strong>Connections at risk</strong><br><br></div><ul><li>Quarterly or annual jobs</li><li>Seasonal transfers</li><li>Dormant or test connections that sit idle past 30 days</li></ul><div>Enforcement: 21 October 2026 on sandboxes and 4 November 2026 on production.<br><br></div><div><strong>Connections set up with a username and password<br></strong><br></div><div>Rapidi's Salesforce connector can also connect with a username and password. That option uses the Salesforce SOAP API login() call, not the OAuth 2.0 username-password flow, so it is outside the scope of this Salesforce notice.<br><br></div><div>Salesforce has been tightening SOAP logins separately. If any of your connections are still configured with a username and password, we recommend moving them to OAuth on its own merits.<br><br></div></div>
</template></turbo-stream>

