New in Salesforce connector: PKCE authentication and Refresh Token Rotation (RTR) support

You can now authenticate your Salesforce connections using PKCE (Proof Key for Code Exchange) in addition to standard OAuth 2.0, and enable Refresh Token Rotation for improved long‑term credential security. When creating a Salesforce connection, choose the authentication method from the new Connection type dropdown.

Overview

This update adds two security‑focused options to the Salesforce connector: PKCE for secure, browser‑based authorization flows (recommended for public clients and scenarios where a client secret cannot be safely stored), and Refresh Token Rotation (RTR) to automatically rotate refresh tokens and reduce risk from long‑lived credentials. 

What’s new

• PKCE (Proof Key for Code Exchange) — Authenticate without a client secret by using a code verifier/challenge flow. Useful for public clients or environments where storing a client secret is not desirable.
• Refresh Token Rotation (RTR) — Optionally enable RTR for Salesforce connections so refresh tokens are rotated on each use. This reduces exposure from token theft and aligns with modern security best practices.

Why this matters

These enhancements strengthen the security and flexibility of Salesforce integrations in Fusion:

• PKCE removes the need to store a client secret for browser‑based or public integrations, lowering the risk of credential leakage.
• Refresh Token Rotation reduces the window of opportunity for misuse if a refresh token is compromised and supports better long‑term credential hygiene.

How to get started

1. Open Fusion and create or edit a scenario.
2. Add or edit your Salesforce connector module and open the connection dialog.
3. In the Connection type dropdown, select either OAuth 2.0 or PKCE based on your environment and security requirements.
4. If PKCE is selected, follow the guided authorization steps in the dialog — Fusion will generate the code challenge and complete the PKCE flow for you.
5. Refresh Token Rotation, should be enabled on Salesforce setup.
6. Test the connection in a non‑production environment to confirm authentication and token rotation behavior before deploying to production.

Before you start

• Review your organization’s security and compliance policies for OAuth client configuration and token rotation.
• Ensure the connected Salesforce app is configured to allow the PKCE flow and RTR if you plan to enable them. Salesforce admin privileges may be required to adjust the connected app.
• Plan to test in a non‑production org or sandbox before enabling RTR in production scenarios.

Where to find documentation

See Experience League for full Salesforce module reference and connection field details:

• Experience League — Salesforce modules and their fields

Need help or want to give feedback?

If you have questions, run into issues, or want to suggest enhancements (for example, improved RTR monitoring, connection migration tools, or templated PKCE setup for common Salesforce orgs), please:

• Post a comment on the Experience League article
• Start a thread in the Experience League Community
• Contact Adobe Support through the Admin Console Support portal

Your feedback helps us prioritize future improvements.