Devices and Things
Module 5 of 7 in the chapter SSO or OAuth? Choosing the Mechanism, chapter 5 of Securing Salesforce: Identity and Access. Each module stands on its own.
The question this module answers: What if the thing starting the conversation isn’t a person or a server, but a device?
The last two rows
Section titled “The last two rows”The map has two more rows, at the bottom. They’re short, and they don’t come up often, but you should know where they sit.
- A device, with a person who approves it. The device starts it, then a person gets involved to say yes.
- A connected thing. A sensor or a machine that sends its data to Salesforce on its own.
Both reach Salesforce’s API, so both are OAuth.
The smart TV
Section titled “The smart TV”You’ve done this one at home. You set up someone’s TV, open a streaming app, and select sign in. The TV has no keyboard, or a terrible one. So instead of asking for a password, it puts a code on the screen, or a QR code. That code is only good for a few minutes.
You pick up your phone, go to the address it shows, log in there, and type in the code or scan it. And while you do, the TV is checking: am I allowed in? Am I allowed in? Am I allowed in? The moment you approve, the next check says yes, and the token goes to the TV, not to you.
That’s the device flow. Salesforce describes it as being for “apps that run on devices with limited input or display capabilities, such as Smart TVs, appliances, and other IoT devices”, and command-line apps can use it too (S1). In Salesforce, both codes, the one the device holds and the one the person types in, are valid for 10 minutes, and the device waits a set number of seconds between its checks (S10). The key element is that it starts with the device. The person and the device aren’t connected electronically. They’re connected visually, by a code you read off one screen and type into another.
The device flow has been tightened
Section titled “The device flow has been tightened”A code approved on another screen only proves that someone approved it, not that they started it. So Salesforce has narrowed where the flow works, to “prevent illegitimate use of the device flow” (S4). From November 30, 2026, the device flow works only for local External Client Apps with a localhost callback URL; it stops working for connected apps and packaged External Client Apps (S4). If you meet a device flow integration, check it against that rule. And only approve a code you started yourself.
Connected things: the asset token flow
Section titled “Connected things: the asset token flow”The last row is the internet of things: devices that send data with no person involved at all. You might have assets in your Salesforce org, records for the machines you’ve sold or installed, and want those machines to connect up to Salesforce and send their data.
That’s the asset token flow. An asset token is a JWT that identifies the device to the service that handles its stream of data, and links it to the customer, account or contact in Salesforce (S1). You won’t set this one up often, but now you know where it sits: a thing, reaching the API, as itself.
Test knowledge. Not big on the test, in my experience. Know which row each one fits: the device flow when a device with no keyboard needs a person to approve it, the asset token flow for connected things linked to asset records.
On the map
Section titled “On the map”On the grid of every way to sign in (module 6), this module is one short set: devices and things.
Watch it on video
Section titled “Watch it on video”In 2023 I made a video of the device flow, with a demo. The note under the video says what’s still right and what’s changed since.
What’s next
Section titled “What’s next”Module 6 puts all seven rows in one table, with the flows that are retiring.
What an architect decides here
Section titled “What an architect decides here”- Whether any device or connected thing reaches the org, and through which flow.
- For the device flow: a local External Client App with a localhost callback (from 2026-11-30), and what users are told about approving codes.
- For connected things: which asset records they link to, and what data they may send.
Explore
Section titled “Explore”- OAuth Authorization Flows (opens in a new tab) (Salesforce Help, Winter ‘27; checked 2026-11-07)
- OAuth 2.0 Device Flow for IoT Integration (opens in a new tab) (Salesforce Help, Winter ‘27; checked 2026-11-07)
- Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update) (opens in a new tab) (Salesforce Release Notes, Winter ‘27; checked 2026-11-07)