Genesys Cloud - Developer Announcements!

Summary

Salesforce has announced the retirement of support for the “Username-Password flow” for “connected apps” in the “Winter 2027” release. This retirement will cause Salesforce Data Action authentication failures until the integration credentials are updated to “Client Credential Flow” credentials.

Salesforce retirement documentation:Salesforce help

While winter releases have historically rolled out between late September to mid October, the app that is used by Salesforce Data Action integration is in danger of being shut down by Salesforce as soon as July 17th. While we are requesting that this app be allowed to function until the overall retirement of the Username-Password flow, we highly recommend that customer migrate to the new credential type as soon as possible to avoid any chance of an outage.

Migrating to the new credential type does not require any downtime or republishing for existing data actions as the credentials can be updated for existing integrations. However, we highly recommend that customers create a new integration with the new credentials in order to validate the new credentials prior to upgrading an existing integration. See the “Best practice for updating credentials” in the migration guide: salesforce-oauth-client-credentials-flow-migration-guide

Note, the client credentials of an External Client App are able to run in the context of a user. In order to minimize the possibility of disruption we suggest that the External Client App be configured to run as the same user as your existing Salesforce Data Action Integration is configured to use.

Action required

Customers using the Salesforce Data Action Integration must migrate to Client Credentials.

Failure to migrate may result in authentication failures beginning as early as July 17, 2026 if Salesforce disables the connected app before the official retirement date.

Effective Date

Friday, July 17, 2026

Contacts

Please reply to this announcement with any questions. This helps the wider developer community benefit from the discussion. We encourage you to use this thread before contacting the designated person directly. Thank you for your understanding.

Thank you for sharing

Based on conversations with Salesforce, the Connected App currently used by the Salesforce Data Actions Username / Password flow will continue to function until the Winter 2027 release.

Hi @Jason Mathison thanks for the update, regarding your last post I understand that there shouldn't be any issues after July 17th. Since username password flow credentials will remain active until winter 2027. 

my question is, from what date can the customer begin this migration? If the Salesforce instance also needs to support salesforceOAuthClientCredentialFlow, what would be the recommended timeline for the customer to begin migration?

Thanks in advance.

Regards.

Everything is in place for customers to migrate today.

I would recommend that customers begin the migration as soon as possible since Salesforce has deprecated the Username/Password flow as being less secure.

Hi Jason could you please confirm where the original date of July 17th came from?

Hi Vaun,

We received a partner email from Salesforce about the oAuth client that is used by Salesforce Data Actions needing to change authentication style by a certain date or it would stop functioning. That date was extended to July 17th and then was extended again to the Winter 27 release.

Hi @Jason Mathison : From Resource Center it says 7th October 2026 - Could you please confirm we have time till Feb 2027 ?

Genesys Cloud – Deprecation: Salesforce data action username and password credential type - Genesys Cloud Resource Center

Thanks!

Suresh U

Hi,

It has been postponed to Feb 2027. 

https://help.salesforce.com/s/articleView?id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5

The release notes for next week show:

The latest update from Salesforce is that the authentication type will be turned off on February 20, 2027: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5

Genesys will not retire our support for this authentication type early, so you should have until at least February 20, 2027 to migrate.

We will get our documentation updated to match that.

As there has been some ongoing confusion regarding the various dates that have been thrown around, I'd like to offer a definitive statement on the Genesys position regarding dates.  Tl;Dr: we're sticking with the Oct 7th date, but will not be taking active steps to remove/disable integrations that continue to use Un/Pw auth.  At some point on or after Oct 7th that variant of auth will cease to work, with the exact timing of that being enforced on the Salesforce end of the integration.  Our advice is to update the authentication used by the integration ASAP.

Longer Statement:

We have been staying with the date reflected in our deprecation announcement,  in part as a defensive measure relating to additional conversations with Salesforce.  Our data action integration is backed globally by a single oauth client that runs in one of our Salesforce development orgs; that Oauth client has already been flagged by Salesforce security as part of their platform review that lead to their decision to deprecate the UN/PW oauth flow.  While the official deprecation of the UN/PW flow may have been pushed out by Salesforce, our specific Oauth client remains in a bit of a tenuous position, and I don't have a high degree of confidence it will be allowed to remain in operation up to the official end of life of the UN/PW oauth flow.  

The migration path for customers is relatively simple, and comes with quite a few benefits to the customer.  The update to the integration added support for Client Credential Grant Oauth to the Salesforce REST API, which runs through "External Client Apps" (ECA) that are created and administered within the customer's own Salesforce org.  This gives them more granular control over the permissioning and scopes used by the Oauth client, and also constrains access to only their organization.  Additionally, it allows for the auth token that is minted to be formed as a JWT, which fits with Salesforce's newest features in terms of authorization patterns. 

Once the ECA is created, we recommend the customer setup a new Salesforce data action integration to serve as a test vehicle for the updated credentials.  Once they're satisfied the ECA is correctly configured, they then update the credentials on their prior existing Salesforce  Data Action integration, which immediately causes all of the data actions they've deployed through flows, scripts, etc. to use the updated auth.  They can then delete the test integration they created, and the process is complete. 

Given the  background of the entire situation, the ease of the migration, and the additional benefits to the customer, we are sticking with the statement that "on or after October 7th, the username/password authentication will cease to work".  We are not actively taking steps to disable this auth pattern, but cannot provide any guarantees it will operate after that date, and are actively recommending that customers make the transition as quickly as possible to avoid any disruption. 

As there has been some confusion regarding dates/timelines surrounding the end of life of the username/password auth flow and its impact on the Salesforce Data Action integration, I have created this post to attempt to clarify the Genesys position on the topic: https://community.genesys.com/discussion/clarification-on-salesforce-data-action-username-password-authentication-deprecation