Salesforce: Migrating to OAuthPKCE Authentication

Salesforce is requiring PKCE and Refresh Token Rotation for OAuth connected apps. CData Connect AI migrates automatically; Drivers, Sync, and Arc customers must update their connection strings and re-authenticate.

Date Entered: 05/11/2025    Last Updated: 05/11/2025

Overview

Salesforce is enforcing new security requirements for OAuth connected apps — specifically, support for PKCE (Proof Key for Code Exchange) and Refresh Token Rotation. Existing Salesforce connections using AuthScheme=OAuth (the standard OAuth 2.0 flow without PKCE) will stop working once Salesforce enforces these requirements.

The replacement is AuthScheme=OAuthPKCE. CData has already released updated drivers and connection handling to support this flow.

Note: Salesforce has not published a hard-enforcement date. CData recommends migrating as soon as possible. This notice will be updated when a deadline is confirmed.

Who is Affected

Category Details
Products Affected CData Drivers for Salesforce, CData Sync (Salesforce connections), CData Arc (Salesforce connections)
Auth Scheme Affected AuthScheme=OAuth
Not Affected CData Connect AI — migrates automatically (see below). Connections using AuthScheme=Basic or other non-OAuth schemes.
Hard Deadline Not yet published by Salesforce — migrate as soon as possible

CData Connect AI: No Action Required

CData Connect AI automatically migrates existing Salesforce connections from AuthScheme=OAuth to AuthScheme=OAuthPKCE at runtime. Existing tokens continue to work. No configuration changes are needed.

CData Drivers, Sync, and Arc: Migration Required

If you are currently using AuthScheme=OAuth, please migrate to OAuthPKCE at your earliest convenience.

CData Drivers for Salesforce

  1. Download and install the latest CData Salesforce Driver (Build 25.0.9624 or later).
  2. Re-connect to Salesforce using AuthScheme=OAuthPKCE.

CData Sync (Salesforce Connection users)

  1. Download the latest Salesforce Connector (25.0.9624 or later) from CData Sync.
  2. Change the AuthScheme to OAuthPKCE and reconnect.

Note: Customers using CData Sync older than v25.3 should contact CData Support for manual installation of the new Salesforce Connector.

CData Arc

  1. Download the latest Salesforce Connector (25.0.9624 or later) from CData Arc.
  2. Change the AuthScheme to OAuthPKCE and reconnect.

Note: Customers using CData Arc older than v26.1 should contact CData Support for manual installation of the new Salesforce Connector.

Support

Contact the CData Support Team if you have questions or need assistance with your migration.


We appreciate your feedback.  If you have any questions, comments, or suggestions about this entry, please contact our support team at [email protected].