Migrate to OAuth Flows

Salesforce has disabled the creation of connected apps and announced the retirement of the SOAP API login() method. As a result, Resource Owner Password Credentials (ROPC) and Salesforce Username Password Policy are no longer supported for establishing new connections.

You must migrate to OAuth-based authentication using external client apps to ensure uninterrupted connectivity.

The following sections provide additional information:

Reason to Migrate Resource Owner Password Credentials (ROPC)-Based Connections

Salesforce has disabled the creation of new connected apps and will also deprecate the Resource Owner Password Credentials security policy in the near future. Resource Owner Password Credentials security policy connections using the existing connected apps are only supported until the Winter 2027 release.

Integrations using Resource Owner Password Credentials-based Salesforce connections must be migrated to a Salesforce Adapter connection that does not rely on connected apps. Failure to complete this migration before the deadline may result in integration disruption.

Along with migration to OAuth flows, Salesforce is also enforcing the use of a custom domain (My Domain) for more secure and reliable authentication. Add the custom domain URL to the Salesforce Adapter connection. See Prerequisites for Oracle Integration Release 20.2.2.0.0 (200524.0200.35760) or Later and Configure Connection Properties.

Note:

See Salesforce Platform: New Connected Apps Can No Longer Be Created in Spring '26 and External Client Apps.

Reason to Migrate Username Password Policy-Based Connections

Salesforce has announced the retirement of the SOAP API login() method in API versions 31.0 through 64.0 with the Summer 2027 release. Additionally, the login() method is not available in API version 65.0 and later. As a result, Salesforce Username Password policy is no longer supported for new connections created with API version 65 or later.

Integrations using Salesforce Adapter connections configured with the Username Password policy must be migrated to OAuth-based authentication using External Client Apps before the Summer ’27 release. Failure to complete this migration before the deadline may result in authentication failures and integration disruption.

Note:

Details are provided on the Salesforce web site. See Platform SOAP API login() Retirement.

Migration Steps

The following topics are covered:

Eligibility Criteria for Migrating a Connected App to an External Client App

An existing connected app can be migrated to an external client app only if it fulfills certain requirements.
  • You must have Create, Edit, and Delete External Client App permissions through the System Administrator profile or a custom permission set.
  • The app must not depend on the OAuth 2.0 username-password flow because that flow is not supported for external client apps.
  • Your organization must use a Salesforce edition that supports external client apps, such as the Professional, Performance, Unlimited, or Developer Edition.

Steps to Migrate the Existing Connected App to an External Client App

Migrate the existing connected app to an external client app. See Create an External Client App from a Connected App. After the migration completes, Salesforce displays a link to the new external client app.

Note:

If the connected app is not eligible for migration, create a new external client app and configure it for the required OAuth flow. See Configure the OAuth – External Client App in Salesforce and Configure Client Credential Flow Security Policies for External Client Apps.

Create or Update the Salesforce Adapter Connection

Once you have created a new client app or converted an existing connected app into an external client app, you can either set up a new Salesforce Adapter connection or update the existing one to use the Authorization Code Credentials or Client Credentials security policy. See Create a Connection.

Replace an Existing Resource Owner Password Credentials or Salesforce Username Password Policy-Based Connections in Your Integration

Once you have created a new connection, follow these steps to reflect the changes in your integration.
  1. Go to the location of the integration to edit.
    • In a project:
      1. In the navigation pane, click Projects.
      2. Select the project name.
      3. Click Integrations Integration icon.
      4. In the Integrations section, select the integration currently using the Resource Owner Password Credentials or Salesforce Username Password Policy connection.
    • Outside a project:
      1. In the navigation pane, click Design, then Integrations.
      2. Select the integration currently using the Resource Owner Password Credentials or Salesforce Username Password Policy connection.
  2. If you have created a new Salesforce Adapter connection, click Actions Actions icon, then select Configure.
  3. In the Configuration Editor, select the Salesforce Adapter connection, and click Replace.
  4. Click Save.
  5. If you have updated the Salesforce Adapter connection, click Save & reactivate to reactivate the integration.

Refresh Integration Endpoints and Activate the Integration

  1. Go to the location of the integration to refresh and activate.
    • In a project:
      1. In the navigation pane, click Projects.
      2. Select the project name.
      3. Click Integrations Integration icon.
      4. In the Integrations section, find the integration to refresh.
    • Outside a project:
      1. In the navigation pane, click Design, then Integrations.
      2. Find the integration to refresh.
  2. Select the integration.
  3. Click Actions Actions icon, then select Refresh Endpoints.

    A confirmation message indicates a successful refresh.

  4. Once the refresh is successful, activate the integration.