Salesforce OAuth migration to Client Credentials
Required action for integrations with username-password authentication
Salesforce is retiring the OAuth 2.0 Username-Password flow for connected app integrations in Winter 2027, with enforcement planned from February 20, 2027. Once enforced, integrations that continue to authenticate using a Salesforce username, password, and security token stop working. Salesforce recommends the Client Credentials flow for server-to-server integrations.
For details, see article Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update).
Affected integrations
This change affects Medallia for Salesforce integrations where username-password authentication is configured, including:
-
Invitation sync Omni Exporters.
-
Response sync Omni Exporters.
-
Any customer-specific Omni Exporter authenticating directly with Salesforce.
For information about these integrations, see Sending data from Medallia to Salesforce and Troubleshooting Omni Exporter for Salesforce.
Required action
Clients, supported by their implementation partner or Medallia team, must:
-
Create a customer-owned Salesforce External Client App using the OAuth 2.0 Client Credentials flow.
-
Assign a dedicated Salesforce integration user as the
Run As user, with the required API, object, field, and record-level access. -
Securely provide the generated client ID and client secret through an approved credential-sharing mechanism.
-
Update the login configuration of every affected Omni Exporter to use the login headers below:
grant_type : client_credentials, client_secret : <Consumer Key>, client_id : <Consumer Secret>,For information about Omni Exporter OAuth login headers, see OAuth Login properties.
-
Complete token validation and end-to-end testing before the Salesforce enforcement date.
The migration changes only the Salesforce authentication configuration. Existing business logic, object and field mappings, filters, schedules, and downstream API operations remain unchanged.
The attached migration guide provides the complete Salesforce configuration, Medallia update, validation, cutover, troubleshooting, and decommissioning steps. It should be used as the primary reference by clients, partners, Support, Client Services, and Implementation teams.
