Skip to main content

Salesforce OAuth Security Update — Verify Your Nue ↔ Salesforce Integration Settings

Learn what's changing with Salesforce OAuth security requirements effective May 11, 2026, and how to verify your Nue integration settings are up to date.

What's happening?

Salesforce is rolling out new security requirements for OAuth apps used in AppExchange integrations, effective May 11, 2026. As part of this change, all OAuth apps connecting to Nue must have the following settings enabled and locked:

  • Proof Key for Code Exchange (PKCE)

  • Refresh Token Rotation

  • 30-day Idle Refresh Token TTL

These requirements apply regardless of which OAuth artifact your org uses — managed-package Connected App or managed-package External Client App.

What's changing on Nue's side?

We're updating all Nue-owned Connected Apps and External Client Apps — including the "Nue Revenue Builder" managed package and the "Nue OAuth" apps that Nue provisions in your org during Connect to require these settings.

Going forward, new Connect and Reconnect flows will use the latest External Client App "Nue Revenue Builder" (released March 2026) for improved security and packaging.

What do I need to do?

This is a one-time check that takes approximately 2 minutes. You need to verify that PKCE, Refresh Token Rotation, and the 30-day Idle TTL are enabled on the Connected App or External Client App used to authenticate Nue in your Salesforce org. If they're already enabled, you can skip directly to step 5 to lock them.

  1. In Salesforce Setup, open App Manager and find the app used to authenticate Nue (typically "Nue Revenue Builder" or "Nue OAuth", or a Connected App you created yourself).

  2. Click View → Settings → Edit.

  3. Under OAuth Policies, enable all of the following:

    • "Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows"

    • "Rotate refresh tokens after use"

    • "Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days"

  4. Save.

  5. Scroll up to Review Controls. Each of the three settings above will be listed there with unchecked status. Check each one to lock the setting.

⚠️ Important: After locking, only Salesforce Customer Support can reverse the lock — so confirm your other Salesforce integrations still work with these settings before locking.

Will this affect my existing connection?

No. Flipping and locking these settings does not affect existing live tokens or scheduled jobs. No Reconnect is required.

Need help?

If you have any questions or run into issues, reach out to your account team or contact us at [email protected].

— The Nue Team

Did this answer your question?