OAuth2 Connection Strings
Salesforce is retiring the SOAP Partner API login with the release of API v65.0 (Winter '26), and globally for all API versions beginning Jun 1, 2027. This will disable the previous connection string configuration using password and security token.
The versions of S4S noted below include both OAuth2 support and remain at Salesforce API v64.0 for Partner API login support.
OAuth2 process for unattended server-to-server connections
S4S support for connection strings that use OAuth2 refresh tokens is available beginning with the following versions:
2.1042.25328
2.1032.25328
2.916.25328
G4S 2.1.25316
The connection string stored in the Sitecore configuration file includes a refresh token obtained by one-off authentication process performed using an external application. This can be performed via PowerShell script (recommended), the free SFDC Explorer tool, or any other means of implementing a Salesforce OAuth2 login flow which generates a refresh token.
At this stage there is no authentication process available within Sitecore/S4S.
External Client App
May 4, 2026 Due to Salesforce restrictions, we no longer recommend using the FuseIT Connected App. Please create your own External Client App for API connections.
Custom App
When you use a custom App, S4S needs to know the credentials for this app. These are added as a separate connection string.
<add name="Custom_Connected_App" connectionString="OAUTH2:key=connectedAppId;secret=optionalSecret" />The Connected App must support the api, refresh_token and web scopes.
If the Connected App requires the client secret for the refresh token flow, include the secret parameter. If not, omit it entirely. If the refresh token is set to expire automatically the connection string below will need updating periodically.
S4S does not presently support refresh token rotation. Sitecore connection strings cannot be updated without causing application restart, and multiple copies are required for disparate processes (e.g. CM/CD). We recommend disabling token rotation. You may wish to enable IP Allowlist Ranges to restrict to your web services for improved security instead.
Salesforce permissions
Beginning September 2025, Salesforce restricts the use of Connected Apps that are not directly installed in the target org. Either:
The Connected App must be installed, or
The authenticating user must have the new Approve Uninstalled Connected Apps permission.
If you receive an OAUTH_APPROVAL_ERROR_GENERIC response during the authentication process, this may be the issue.
Customers should note that Salesforce has subsequently altered their security requirements for Connected and External Client Apps provided by Partners:
On May 11, 2026, we will be obligated to enforce PKCE code challenge, refresh token rotation/TTL, and IP Allowlist Ranges on the Connected Apps we provide.
PKCE is applicable during initial authentication only, and is not yet supported by SFDC Explorer. Until this is resolved, the workaround is to use the PowerShell script referenced below to authenticate if PKCE support is required.
Refresh token rotation is problematic with Sitecore due to the distributed nature of services.
IP Allowlist Ranges will result in disabling refresh token functionality, making them unsuitable for use with customer S4S installations.
At this time we recommend anyone using S4S with OAuth2 connection strings to use their own External Client App, with refresh token rotation disabled.
Refresh token connection string
Authenticate to obtain refresh token
Perform the authentication process using your chosen external application.
An example PowerShell script can be found here. This is the preferred option at present as it includes support for PKCE.
Instructions for using FuseIT’s free SFDC Explorer tool can be found here.
Note that a refresh token is required; the access token is short-lived and not suitable for creating new sessions.
Create default S4S connection string
Add a connection string with the refresh token value. Replace {mydomain} and {token} with values for your Salesforce org.
<add name="S4SConnString" connectionString="S4S:environment={mydomain}.my.salesforce.com;type=OAuth;refresh token={token};connected app={appname}" />In the string above, {appname} is the value of the name= attribute of the Connect App connection string. E.g. to match the example above this would be Custom_Connected_App.