Could Salesforce Winter ’27 Break Your Integrations? What Businesses Need to Check

Yes, Winter ’27 can break some Salesforce integrations, though most will carry on as normal. The risk sits with connections that use older login methods or run infrequently. Idle refresh tokens now expire after 30 days, and several older OAuth flows retire on 20 February 2027. Check how each integration logs in, and test it in a sandbox.

Your Salesforce system doesn’t work in isolation. It probably talks to your accounting software, marketing platform, website forms, phone system and a few other tools. Each of those connections has to log in to Salesforce, and Winter ’27 tightens the rules on how they do it.

How do Salesforce integrations work?

In simple terms, an integration is another system with permission to read or update your Salesforce data. To get that permission it logs in, usually through an app set up in Salesforce, often using a dedicated integration user. Salesforce hands it a token, a bit like a visitor pass, and the integration shows that pass each time it asks for data.

Most modern integrations use OAuth, which lets them log in without storing anyone’s password. Older ones may still use a username and password, or the SOAP API login() call. Those older methods are what Salesforce is now phasing out.

What authentication changes come with Winter ’27?

Salesforce’s Winter ’27 architect highlights and its security roadmap set out the dates. Here’s what’s confirmed:

• 4 November 2026: refresh tokens left unused for 30 days expire in production orgs (sandboxes from 21 October). Tokens that were already idle for 30 days expired as soon as the rule arrived.
• 30 November 2026: the OAuth device flow is restricted to local external client apps.
• 1 December 2026: SOAP API login() only works for users with the Use Any API Auth permission.
• 31 January 2027: in production, SOAP login() needs a security token when broad login IP ranges are set, and switches off in orgs that haven’t used it for six months.
• 20 February 2027: the OAuth username-password, user-agent and hybrid flows retire.
• Summer ’27: connected apps reach end of support, with external client apps replacing them, and SOAP login() retires in API versions 31.0 to 64.0.

What are refresh tokens, connected apps and integration users?

A refresh token lets an integration get a new pass without someone logging in again. Under the new rule, if it isn’t used for 30 days it expires, and the integration gets an “expired access/refresh token” error. That’s a problem for anything that runs monthly, quarterly or once a year.

A connected app is the record in Salesforce that defines how an outside system may connect. Salesforce is replacing these with external client apps, which are closed by default and separate the developer’s settings from the admin’s. Your existing connected apps keep working for now, but they won’t get fixes after Summer ’27.

An integration user is the Salesforce account an integration acts as. If that user is frozen, loses a permission or belongs to someone who has left, the integration fails along with it.

What happens to the business if an integration fails?

This is where it stops being a technical issue. A broken connection rarely announces itself. Instead, website enquiries stop appearing as leads, invoices stop syncing to your finance system, or your marketing platform keeps emailing people who’ve already bought. Sales teams work from stale data, and nobody notices until a customer complains or the month-end figures don’t add up.

5 warning signs your Salesforce integrations need attention

1. Failed synchronisations: sync logs in your other systems show errors or retries, or the last successful sync was days ago.
2. Missing leads: web form or marketing leads drop suddenly while website traffic looks normal.
3. Authentication errors: messages such as “invalid_grant”, “expired access/refresh token” or INVALID_SESSION_ID appear in logs or admin emails.
4. Outdated records: balances, order statuses or contact details in Salesforce no longer match the source system.
5. Unexpected automation failures: Flows that depend on integrated data start failing, or Paused and Failed Flow Interviews fills up.

How do you find which integrations need attention?

Start with a simple list: every system connected to Salesforce, who owns it, how it logs in and how often it runs. Then use Salesforce’s own tools to fill the gaps:

• Login History: create a view filtered on Login Subtype to spot OAuth username-password logins. It only keeps six months of history, so rare jobs may not show.
• Connected Apps OAuth Usage: lists the apps your users connect through. Apps using the username-password flow don’t appear here, so don’t treat it as the full picture.
• Release Updates: look for items about SOAP login() and connected apps, and use the test runs where offered.
• Your vendors: ask each supplier which login method their connector uses and when they’ll support external client apps.

While you’re there, check API versions. Calls to versions 21.0 to 30.0 were retired in 2025, which still catches out very old Data Loader installs.

How do you test integrations safely?

Use a sandbox. Refresh one so it matches production, point a test copy of each integration at it and run a real transaction: a new lead, an invoice, a contact update. Salesforce’s release countdown explains how sandboxes get the next release early, so you can repeat this before Spring ’27.

Two tips from our own projects. Test as the integration user, not as an admin, because admins have permissions the integration won’t. And for monthly or quarterly jobs, run them on demand rather than waiting for the schedule.

What should you do if an integration stops working?

1. Check the error message in the other system’s log. Token and session errors point to authentication.
2. Re-authorise the connection. For expired refresh tokens this is often all it takes.
3. Confirm the integration user is active and still has the permissions it needs.
4. Check Salesforce’s status and Known Issues pages for anything affecting your instance.
5. Plan the permanent fix: move to a supported OAuth flow and an external client app.

Once things are running, find out what was missed while the connection was down and backfill it. If records have drifted badly, our guide to signs it’s time for a data migration explains the options.

How Apex can help

Integrations are where most Winter ’27 risk sits, and they’re easy to overlook because they run in the background. Our Salesforce team can review every connection, update older login methods and set up external client apps with you. Read more about our Salesforce integration services or our practical guide to successful Salesforce integration.

If you haven’t read it yet, our overview of 7 Salesforce Winter ’27 changes covers the rest of the release. And if you’d like a second pair of eyes, book a free Salesforce health check or get in touch.

Frequently asked questions

What is the Salesforce 30-day refresh token rule?

From 4 November 2026 in production, an OAuth refresh token that isn’t used for 30 days expires. The integration then has to be re-authorised. It mostly affects jobs that run monthly, quarterly or less often.

When does the Salesforce OAuth username-password flow retire?

The OAuth username-password flow, along with the user-agent and hybrid flows, retires on 20 February 2027. It was due in Winter ’27 but Salesforce postponed it. Integrations using it should move to a supported flow.

What are Salesforce external client apps?

External client apps replace connected apps for letting outside systems connect to Salesforce. They’re closed by default and separate developer and admin settings. Connected apps reach end of support in Summer ’27.

How can I tell if a Salesforce integration has stopped working?

Look for sync errors, missing leads, records that don’t match the other system and authentication errors such as invalid_grant. Comparing record counts between systems is a quick test.