Salesforce Winter '27 and Your Integrations: Connected Apps, OAuth Flows and API Retirements

Nothing stops on upgrade weekend for most integrations, but the dates are set: SOAP login() needs a new permission this release, the OAuth device flow ends 30 November 2026, username-password and user-agent flows end 20 February 2027, connected apps lose support in Summer '27, API versions 31.0 to 40.0 retire in Summer '28, and Microsoft retires EWS in October 2026.

Post 1 covers the full release-update list; this post covers integrations only. One correction to our July post: the username-password retirement we listed as enforcing from September 2026 is postponed to 20 February 2027, per the Winter '27 release notes. Australian-hosted (AUS) instances upgrade on Saturday 10 October UTC (early Sunday 11 October in New Zealand) per Salesforce Trust; check yours.

Which integrations are at risk, and when?

Dates are as at September 2026, from the linked Salesforce page; release names land on your instance's upgrade weekend for that release.

Change	Date	Affected	Replacement	Source
Use Any API Auth permission for SOAP login()	Winter '27, with this release	All API enabled editions	Assign via profile or permission set	Update
Microsoft retires Exchange Web Services (EWS)	October 2026	Einstein Activity Capture, Lightning Sync, Inbox on Microsoft 365	Microsoft Graph	Note
Instanced URLs blocked in API traffic	Sandboxes 22 to 23 October and 3 to 5 November 2026; production in four phases, 12 January to 25 March 2027	All editions except Database.com	My Domain login URL	Update, schedule
OAuth 2.0 device flow restricted	30 November 2026	Connected and external client apps, all editions	Local external client app, localhost callback	Update
Username-password flow retired	20 February 2027	Connected apps, all editions	Web-server flow with PKCE, or client credentials	Update
User-agent and hybrid user-agent flows retired	20 February 2027	All editions	Web-server or hybrid web-server flow with PKCE	Update
Cross-org adapter legacy authentication retired	Spring '27	Enterprise, Performance, Unlimited, Developer	Named credentials	Update
Salesforce to Salesforce retired	Spring '27	Classic orgs with it enabled	Partner Cloud, Data Cloud One, MuleSoft Anypoint or MuleSoft for Flow	Update
Connected apps lose support	Summer '27	Lightning Experience; Enterprise, Unlimited, Developer	External client apps	Update
SOAP login() retired in API 31.0 to 64.0	Summer '27	API-enabled Professional, Enterprise, Performance, Unlimited, Developer	External client apps and OAuth	Update, KA
Platform API 31.0 to 40.0	Deprecated Summer '27; retired Summer '28	REST, SOAP, Bulk, all /services/data/ APIs	Version 41.0 or later	Note
Lightning Sync retired	2027	Professional, Enterprise, Performance, Unlimited, Developer	Einstein Activity Capture	Note
Salesforce for Outlook retired	December 2027	Contact Manager through Developer editions	Outlook integration, Einstein Activity Capture	Note

One caution on the instanced-URL schedule: the knowledge article's summary says enforcement begins "with sandbox instances in October 2026 and production instances in November 2026", but its own table starts production on 12 to 14 January 2027 and finishes on 23 to 25 March 2027. Work from the table. The Release Updates landing page also files the SOAP login() retirement under Spring '27 while its page says Summer '27.

How do you find out which flow an integration uses?

Start with SOAP login(), because the knowledge article gives a recipe: in Login History, look for LoginType "Other Apex API" or "Partner Product", Login Subtype "SOAP API", and API Type "SOAP Enterprise", "SOAP Partner" or "SOAP Tooling". Its EventLogFile route (ApiTotalUsage events) is to look for API_FAMILY SOAP with API_RESOURCE login and review every event with an empty CONNECTED_APP_ID. The retirement's test run comes with a warning: "Enabling a test run in production blocks all SOAP API login() calls for the duration of the test, which fails any integrations that have not yet been migrated."

The username-password flow is harder to see, and the migration guide says so: "The migration process can't detect username-password flow. Confirm this flow isn't in use during migration." If the release update is missing from your Setup list, the flow is already blocked. For anything you did not build, the user-agent note gives the only honest method: "For apps that you didn't develop, such as apps installed from managed packages, contact the app developer."

For instanced URLs, since 31 August 2026 you can enable "Block API traffic that uses an incorrect instanced URL" under Setup, My Domain, Redirections; anything still on an instance hostname then gets a 400 Bad Request.

How do you migrate a connected app to an external client app?

The release update is new in Winter '27, enforced for production instances in Summer '27, and its Where line reads "This change applies to Lightning Experience in Enterprise, Unlimited, and Developer editions." Enforcement is soft: "Connected apps will keep working, but Salesforce will no longer fix bugs or provide support for the integrations and authorization flows that use them."

The help article steps: in Setup, open App Manager, open the connected app, click Migrate to External Client App (shown only if the app is eligible), confirm the app is local and does not use the username-password flow, then click Migrate. The migration guide lists six eligibility conditions, including no user provisioning, Canvas, custom Apex handler or dynamic client registration, and single sign-on connected apps cannot be migrated at all.

What you keep: "Migration preserves your consumer key and secret, so existing integrations continue to work." and "Refresh tokens remain valid." Do not delete the original ("Both apps share the same consumer."), and it is UI only: "API and CLI support isn't available." Per the feature comparison, "the OAuth username-password flow won't be made available for external client apps". The help article's edition list (Professional, Performance, Unlimited and Developer) differs from the release update's; on Professional, check App Manager for the button rather than assuming.

How do you replace the username-password flow?

The retirement note names two replacements: "For end user login and authorization, use the OAuth 2.0 web-server flow with the Proof Key for Code Exchange (PKCE) extension." and "For server-to-server integrations, use the OAuth 2.0 client credentials flow." A person logs in and the integration acts as them: web-server flow. A job runs with nobody present, such as a nightly accounting sync: client credentials, which "requires you to specify an integration user to run the integration."

On an external client app it is a Setup job per the help article (Professional, Performance, Unlimited and Developer editions): Edit Settings, Enable OAuth, Enable Client Credentials Flow; then Edit Policies, Enable Client Credentials Flow, enter the execution user's username. Mind the security note: "With this flow enabled, any person or app that has access to your external client app's consumer key and consumer secret can get an access token."

Some third-party posts say the target is the JWT bearer flow. The release note names web-server with PKCE and client credentials; the SOAP login() knowledge article lists "OAuth 2.0 JWT bearer flow or the OAuth 2.0 client credentials flow" for server-to-server work. JWT bearer is an option, not a requirement.

What changes for developers?

Winter '27 is API version 68.0, and per the LWC note "LWC API version 68.0 has no version-specific changes". REST URIs now accept latest in place of a version number. Apex heap limits rise from 6 MB to 10 MB (synchronous) and 12 MB to 25 MB (asynchronous); nonproduction orgs get a temporary "Enforce the Summer '26 Apex heap limit" setting, and Spring '27 enforces the higher limits everywhere. The Developer Console "is not visible by default in Setup"; re-enable it under Web Console. Apex saved at API versions 9.0 through 19.0 now gets compiler warnings ahead of an undated retirement; save it at 20.0 or later.

What does this mean for Xero, Stripe, Outlook and other connectors?

Vendor-managed AppExchange connectors. Breadwinner for Xero, Stripe for Salesforce Platform, Blackthorn, Chargent, and the Zapier and Make connectors belong to their vendors, and so does the flow. Ask each vendor three things this month: which OAuth flow, whether it has moved to an external client app, and which API version it calls. Our Xero options guide and Stripe options guide compare them.

Home-built middleware. A script on a server, a custom build on the Xero API, a callout from another org: nobody patches these for you. Check for the username-password flow and SOAP login() first, then hard-coded instance hostnames and API versions. Fix order: My Domain login URL (formats in the login-with-code article), API version 41.0 or later, then client credentials on an external client app. Our design guide covers the rest of the build.

Salesforce Suites prebuilt integrations. New in August 2026 for Starter Suite and Pro Suite, prebuilt integrations are "Powered by MuleSoft and Flows" and set up from the Automations app. The named examples are QuickBooks Online and Jira; Xero is not named.

Outlook and Microsoft 365. Microsoft retires Exchange Web Services "starting October 2026", and Einstein Activity Capture, Lightning Sync and Inbox on Microsoft 365 each have a Microsoft Graph upgrade in Setup; user-level OAuth users "must reconnect to their Microsoft 365 accounts". Lightning Sync itself "is scheduled to retire in 2027" (the Graph upgrade is a prerequisite for the migration to Einstein Activity Capture), and Salesforce for Outlook retires in December 2027, replaced by the Outlook integration and Einstein Activity Capture. Find out which you run and whether Setup says EWS or Graph.

How SAASKOOL can help

This is what our integration service does: an audit of every connected app, script and connector against the timeline above, the vendor questions put to each supplier, external client app migrations and client-credentials setup, and rebuilds where a home-built sync has to be rewritten. The free health check includes a look at connected apps and pending release updates.

Frequently Asked Questions

Will my Salesforce integrations stop working when Winter '27 lands? For most orgs, no. The only change enforced with the release is that anyone authenticating through SOAP login() needs the Use Any API Auth permission. The rest are dated: device flow 30 November 2026, username-password and user-agent flows 20 February 2027, connected apps and SOAP login() Summer '27, API versions 31.0 to 40.0 Summer '28.

When is the OAuth 2.0 username-password flow retired? On 20 February 2027, postponed from Winter '27 per the release notes. From then, connected-app integrations using the flow stop authenticating; if the release update is missing from your Setup list, the flow is already blocked. The named replacements are the web-server flow with PKCE and the client credentials flow.

Do I have to migrate my connected apps to external client apps? Not to keep them running. From Summer '27, connected apps keep working but Salesforce no longer fixes bugs or provides support for them. Migration is a button in App Manager and keeps the consumer key, secret and refresh tokens. External client apps do not support the username-password flow, so fix that first.

Which Salesforce API versions are being retired? Two separate retirements. Platform API versions 31.0 to 40.0 (REST, SOAP, Bulk and everything under /services/data/) are deprecated in Summer '27 and retired in Summer '28, when calls fail; use 41.0 or later. Separately, SOAP login() in versions 31.0 to 64.0 stops in Summer '27 and is not available from 65.0.

Does the Microsoft EWS retirement affect my Outlook sync with Salesforce? Yes, if Einstein Activity Capture, Lightning Sync or Inbox connects to Microsoft 365 over Exchange Web Services. Microsoft retires EWS from October 2026, and Lightning Sync on EWS will not capture or sync data after that. Upgrade each to Microsoft Graph in Setup. Lightning Sync itself retires in 2027, Salesforce for Outlook in December 2027.

---

SAASKOOL audits, migrates and rebuilds Salesforce integrations through our integration service. Not sure what your org is running? Start with the free health check.