# Salesforce OAuth: New External Client App


RudderStack's [Salesforce]({{< ref "destinations/streaming-destinations/salesforce-v2/" >}}) destination can now authenticate through a new **External Client App (ECA)** built on Salesforce's latest OAuth standards. The new app uses **PKCE (Proof Key for Code Exchange)** for stronger OAuth security and is distributed as a managed package that you install directly in your Salesforce org.

{{< warning >}}
**The previous Salesforce OAuth account type is now deprecated**. 

Your existing Salesforce connections **continue to work as long as no changes are needed** — events will keep flowing normally. However, you cannot create new accounts, edit, or re-authorize with the deprecated account type. Any time you need to update or re-authorize your Salesforce connection, you need to move to the new ECA-based account type. 

RudderStack recommends migrating proactively so the switch happens on your schedule, not in response to an urgent change.
{{< /warning >}}

## Why we made this change

Two things drove this update:

- **Salesforce platform change**: As of the Spring '26 release, Salesforce has permanently disabled the creation of new Connected Apps. All new OAuth integrations must use the External Client App (ECA) model going forward.
- **Stronger OAuth security by design**: The new ECA uses PKCE-based OAuth — the current industry standard for OAuth authorization-code flows and Salesforce's recommended pattern for new integrations.

## What's new

- **New Salesforce OAuth account type** in the RudderStack dashboard, backed by an External Client App under the `rudderstack` namespace.
- **PKCE-enabled OAuth flow** for stronger protection of the authorization exchange.
- **Managed package distribution**: The RudderStack ECA is installed once per Salesforce org, then authorized — a one-time setup step per org.
- **Deprecation state for the previous account type**: read-only for existing connections; no new accounts, edits, or re-authorizations.

## How to migrate

Migration is a one-time, per-org setup.

1. Install the RudderStack ECA managed package in your Salesforce org using the install link provided by RudderStack.
2. Create a new Salesforce OAuth account in the RudderStack dashboard using the new account type.
3. Complete the OAuth authorization to connect the new account to your Salesforce org.
4. Point your Salesforce destination(s) at the new account.

## Impact on existing connections

| State | Behavior |
| --- | --- |
| Existing Salesforce accounts (deprecated type) | Continue to work as long as no changes are needed — events flow as before |
| Creating a new Salesforce account | Must use the new ECA-based account type |
| Editing a deprecated account | Not allowed |
| Re-authorizing a deprecated account | Not allowed — create a new account instead |
| Reusing a deprecated account on a new destination | Not allowed |

## Resources

See the [Salesforce v2 Destination]({{< ref "destinations/streaming-destinations/salesforce-v2/" >}}) for setup instructions and migration steps.

If you need help migrating, reach out to your Customer Success contact or [RudderStack Support](mailto:support@rudderstack.com).