# OAuth flow selection and integration access controls

*Integration Architect Study Guide · Translate Needs to Integration Requirements · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/integration-architect/translate-needs-to-integration-requirements/oauth-flow-selection-and-integration-access-controls*

Pick the OAuth 2.0 flow from three questions about the client, plan for the username-password flow's retirement and the connected app creation restriction, and set least-privilege access, app session policies, real-time blocking, CORS and field-level protection for each integration.

- Certification: Salesforce Integration Architect
- Exam section: Translate Needs to Integration Requirements
- Study guide: https://www.certifyforce.com/study-guide/integration-architect

**Official exam objective:**

> Given a use case, identify integration security / authentication / authorization requirements.

## What the exam expects

- Choose the OAuth 2.0 flow for an integration from who is present, whose identity the calls run as, and whether the client can keep a secret.
- Replace the username-password flow and register new integrations as external client apps.
- Grant least-privilege access to integration users: Apex class access, restriction rules, View All for change event subscribers.
- Apply app session policies (timeout, high assurance, block) and transaction security policies that block in real time.
- Pick protections for browsers and fields: CORS allowlist, deterministic encryption for matching, payload encryption past an untrusted broker.

Key terms: **PKCE** (Proof Key for Code Exchange, protects the authorization code); **refresh token rotation** (each refresh returns a new token and invalidates the old one); **high assurance session** (identity verified with a second factor); **restriction rule** (filters records a user can already access); **deterministic encryption** (same plaintext gives the same ciphertext, so matching works).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Username-password flow in new orgs | Blocked by default in orgs created Summer '23 or later | [OAuth Authorization Flows](https://help.salesforce.com/s/articleView?language=en_US&id=remoteaccess_oauth_flows.htm&type=5) |
| Username-password retirement | Enforced February 20, 2027; orgs from Summer '26 can't enable it | [Username-Password Flow Retirement](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5) |
| New connected apps | Creation restricted as of Spring '26; use external client apps | [Authorization Through External Client Apps or Connected Apps](https://developer.salesforce.com/docs/platform/api-rest/guide/intro-oauth-and-connected-apps.html) |
| Session timeout precedence | App, then profile, then org Session Settings | [Manage Session Policies](https://help.salesforce.com/s/articleView?id=sf.connected_app_manage_session_policies.htm&type=5) |
| High assurance with JWT bearer | API logins blocked: no user approval step | [Manage Session Policies](https://help.salesforce.com/s/articleView?id=sf.connected_app_manage_session_policies.htm&type=5) |
| ApiEvent policy actions | Block, Notifications | [Transaction Security Policy Types](https://help.salesforce.com/s/articleView?id=sf.enhanced_transaction_security_policy_types.htm&type=5) |
| Restriction rules per object | 2 active (Enterprise, Developer); 5 (Performance, Unlimited) | [Restriction Rules](https://help.salesforce.com/s/articleView?id=sf.security_restriction_rule.htm&type=5) |
| CDC subscriber permission | View All Records for the object (View All Data for all entities) | [Change Event Permissions](https://developer.salesforce.com/docs/atlas.en-us.change_data_capture.meta/change_data_capture/cdc_security_perms.htm) |

## Check yourself

- Why does a high assurance requirement break a JWT bearer integration?
- When should a microservice use the token exchange flow?
- What happens when a rotated-out refresh token is presented?
- Why does a Pub/Sub API change event subscriber need View All Records?

## Sources

- [OAuth Authorization Flows](https://help.salesforce.com/s/articleView?language=en_US&id=remoteaccess_oauth_flows.htm&type=5)
- [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5)
- [Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_device_flow_restrictions.htm&language=en_US&release=262&type=5)
- [Authorization Through External Client Apps or Connected Apps and OAuth 2.0](https://developer.salesforce.com/docs/platform/api-rest/guide/intro-oauth-and-connected-apps.html)
- [Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5)
- [Configure the External Client App OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_oauth_settings.htm&type=5)
- [External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&type=5)
- [Manage Session Policies for a Connected App](https://help.salesforce.com/s/articleView?id=sf.connected_app_manage_session_policies.htm&type=5)
- [Give Integration Users API Only Access](https://help.salesforce.com/s/articleView?id=sf.integration_user.htm&type=5)
- [Class Security](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_security.htm)
- [Restriction Rules](https://help.salesforce.com/s/articleView?id=sf.security_restriction_rule.htm&type=5)
- [Required Permissions for Change Event Subscribers](https://developer.salesforce.com/docs/atlas.en-us.change_data_capture.meta/change_data_capture/cdc_security_perms.htm)
- [Transaction Security Policy Types](https://help.salesforce.com/s/articleView?id=sf.enhanced_transaction_security_policy_types.htm&type=5)
- [Configure Salesforce CORS Allowlist](https://help.salesforce.com/s/articleView?id=sf.extend_code_cors.htm&type=5)
- [Filter Encrypted Data with Deterministic Encryption](https://help.salesforce.com/s/articleView?id=sf.security_pe_deterministic.htm&type=5)
- [Integration Security Considerations](https://developer.salesforce.com/docs/atlas.en-us.integration_patterns_and_practices.meta/integration_patterns_and_practices/integ_pat_security_considerations.htm)
- [Field-Level Security for Change Events](https://developer.salesforce.com/docs/atlas.en-us.change_data_capture.meta/change_data_capture/cdc_security_field.htm)
- [Named Credentials](https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams