More secure OAuth Authorization Flows

[intptr-t]

Salesforce does not recommend username-password flows.
To make it more secure, improve to adopt "OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration" or similar.

https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_flows.htm&type=5

Some flows have important security considerations. For example, when using the web server flow, you must store the client secret securely. We recommend avoiding the user-agent and username-password flows because they transmit credentials. Instead, choose a flow that frees the app from having to manage, store, and protect credentials.

Current grant_type

amazon-connect-salesforce-lambda/sam-app/lambda_functions/salesforce.py

Line 53 in 34cb6a0

'grant_type': 'password',

Manual

Additionally, An addition should be added to the manual on how to block it.
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_disable_username_password_flow.htm&type=5

[pcjs156]

Hi, I'd like to work on this issue.

Salesforce has officially announced the retirement of OAuth 2.0 Username-Password Flow for Connected Apps in Winter '27. (release note
(https://help.salesforce.com/s/articleView?id=release-notes.rn_security_unpw_flow_retirement.htm&language=en_US&release=262&type=5))

My proposal is to support both flows with SF_AUTH_FLOW environment variable:

• Default: client_credentials (OAuth 2.0 Client Credentials Flow)
• password: existing Username-Password Flow, with a deprecation warning in logs

This way, existing users won't be immediately broken — they can explicitly set SF_AUTH_FLOW=password to keep the current behavior, while new deployments default to the more secure flow.

Would this approach work? Happy to submit a PR if the direction looks good.