Salesforce Retired the OAuth Username-Password Flow — Is Your Integration About to Break?

An integration that has run untouched for three years, syncing orders every night at 2 a.m. without anyone thinking about it, suddenly starts throwing authentication errors. Nobody touched the code. Nobody rotated a password. Salesforce retired the OAuth Username-Password Flow, and if any of your Connected Apps still authenticate that way, this is exactly what breaking looks like from the outside. This post walks through which integrations are most likely affected, why Login History alone won’t tell you the full story, and what to migrate to before the next scheduled job fails silently overnight.

1. Legacy Integrations Built Years Ago on the Username-Password Flow

This flow shows up most in integrations built before OAuth alternatives were as well-documented as they are now, because it was the simplest one available at the time. A developer building a server-to-server sync years ago could authenticate with just a username, password, and security token, with no browser redirect or certificate exchange required. As a result, it became the default choice for early custom integrations, internal scripts, and anything built by a team without a dedicated integration specialist on staff.

Fix: Start with Setup → App Manager and review every Connected App’s OAuth settings for a Username-Password Flow reference. Prioritize anything built more than two or three years ago, since that’s where this pattern concentrates. Migrate each one to an External Client App configured with JWT Bearer or Client Credentials before it fails on its own schedule.

2. Middleware and ETL Tools Configured With a Static Username, Password, and Token

Middleware platforms and ETL tools are a common second home for this flow, because many were configured once during initial setup and never revisited. A MuleSoft flow, an integration platform connector, or a custom ETL job authenticated with a hardcoded username, password, and security token combination keeps working invisibly for years, right up until the flow it depends on stops being accepted. Notably, these are often the integrations with the widest blast radius, since middleware typically touches multiple downstream systems at once rather than a single point-to-point sync.

Fix: Audit every middleware and ETL connection string for Salesforce credentials stored as username/password/token rather than a certificate or client secret. Reconfigure each one against an External Client App using Client Credentials Flow where the middleware runs server-side without end-user context, or JWT Bearer where you need to authenticate as a specific integration user.

3. Nightly Batch Jobs That Fail Silently With Nobody Watching

Scheduled, headless jobs are where this retirement causes the most damage, precisely because nobody is looking at them when they run. A nightly order sync, an overnight data warehouse export, or a 2 a.m. inventory reconciliation job fails quietly in a log file that nobody checks until a downstream report looks wrong days later. In practice, the delay between the actual failure and someone noticing is often the most expensive part of this problem, not the fix itself.

Fix: Add active failure alerting to every scheduled integration before you migrate anything, so you find out about an authentication failure within minutes instead of days. Then work through the migration list in order of business impact, not build order, so the job feeding your finance team’s morning report gets fixed before a rarely-used internal script.

4. Why Login History Won’t Show You Everything

Login History feels like the obvious place to find every affected integration, but it has a real blind spot. Salesforce only retains Login History for six months, so an integration that authenticated successfully eight or ten months ago and has been running on a long-lived session or refresh token since then may not show a recent OauthUsernamePassword entry at all. Consequently, a Login History search alone can miss exactly the legacy integrations most likely to still be using this flow, since those are often the oldest and least frequently reauthenticated ones.

Fix: Cross-reference Login History with a manual review of every Connected App’s configured OAuth flows in Setup, not just the login activity. Treat any Connected App you can’t positively confirm is using a supported flow as a suspect, even if it doesn’t show up in the last six months of login data. This is exactly the kind of cross-check we build into an integration audit, since it’s the gap between what the report shows and what’s actually still running that causes the surprise outage.

Frequently Asked Questions

Is this actually a Salesforce outage, or something on our end?

It’s neither an outage nor something your team broke. Salesforce intentionally retired the OAuth Username-Password Flow as part of the Winter ’27 release, and any Connected App still configured to use it will stop authenticating once enforcement reaches your instance. The fix is a configuration migration on your side, not a support case with Salesforce.

How urgent is this, exactly?

Enforcement began rolling out in September 2026, with Sandboxes typically receiving the release ahead of Production. If you haven’t audited your Connected Apps yet, treat this as already affecting you rather than something on the horizon, especially for any integration that runs unattended overnight.

What replaces the Username-Password Flow?

The three supported replacements are the JWT Bearer Flow, the Client Credentials Flow, and the Authorization Code Flow with PKCE, and which one fits depends on whether the integration runs server-to-server or involves an actual person logging in. All three require configuring an External Client App rather than the legacy Connected App setup this flow used.

How do I find every integration using this flow before it breaks in production?

Combine a Login History search for OauthUsernamePassword entries with a manual review of every Connected App’s configured OAuth settings in Setup, since Login History’s six-month retention window can miss older, infrequently reauthenticated integrations. A fractional integration or MuleSoft engagement can run that full audit and prioritize the migration list by business impact rather than by which integration happens to fail first.