Integration.
All posts.
Governing Third-Party MCP Servers in Agentforce: The Controls You Have Today
Winter '27 promises MCP risk scoring. Here are the controls that ship today: Agentforce Registry, tool allowlisting, Gateway policies, and their limits.
Standard Volume Platform Events Retire on 15 December 2026: Two Migration Paths, and Only One Lets You Phase It
Standard volume platform events retire on 15 December 2026. The Setup button migrates everything at once. A Metadata API route does them one at a time.
Salesforce Restricts the OAuth Device Flow on 30 November 2026: Your Connected App Has to Become an External Client App
From 30 November 2026 the OAuth device flow works only from local external client apps. Connected apps that use it must migrate or stop authenticating.
Salesforce Retires the OAuth User-Agent Flows on 20 February 2027: Move to Web-Server Flow with PKCE
The OAuth user-agent and hybrid user-agent flows retire on 20 February 2027. What breaks, why a token in the URL is the problem, and where to move next.
Salesforce Winter '27 Requires Use Any API Auth for SOAP login(): Find Your Exposure First
Winter '27 requires the Use Any API Auth permission for SOAP API login(), or the call errors. The queries to size your exposure and check who holds it.
Salesforce Certificate Trust Store: Your Own Root CAs, for Named Credentials Only
Winter '27 lets you upload and manage your own root certificates in Salesforce. The scope is narrower than it first looks, and that scope is the story.
Migrating Connected Apps to External Client Apps: The Tool Now Covers Packaged and Distributed Apps
Connected apps end in Summer '27. The migration tool now covers packaged and distributed apps, and keeps existing tokens and sessions valid through it.
Salesforce Winter '27 Security Readiness: The Release Updates and the Sandbox Window to Test Them
Winter '27 enforces two security changes, not the five widely listed. Three slipped to 2027 or were cancelled. The dates, what breaks, and how to test.
Why Managed Event Subscriptions Should Be How External Systems Subscribe to Your Salesforce Events
External systems subscribing to your events should use managed subscriptions. Why they beat client-managed replay, and how to defend your delivery allocation.
Salesforce Platform Event Delivery Limits: How to Measure, Attribute and Cut Usage
Deliveries are counted per subscriber, so cost grows with consumers rather than event volume. How to measure usage, attribute it per client, and reduce it.
Migrating Legacy Named Credentials Before They Become the Next Salesforce Deadline
Legacy Named Credentials mix secrets and access in one record with no permission set control. Migrate during the Winter '27 window, and how the split works.
Salesforce Stops Supporting Incorrect Instanced URLs in API Traffic, Now Spring '27
Salesforce postponed the instanced URL enforcement to Spring '27, a third slip. Why hardcoded endpoints break, and how to control the cutover yourself.
Salesforce Retires the OAuth Username-Password Flow on 20 February 2027: Migrate Before Your Integrations Break
Salesforce postponed the OAuth 2.0 username-password flow retirement to 20 February 2027. What breaks, how to find affected integrations, and how to migrate.