Salesforce CLI requires a connected app in the org that you're authorizing. We provide a default connected app (called Salesforce CLI) when you authorize an org with the org login web command. The Salesforce CLI connected app is uninstalled by default.

Salesforce recently restricted the use of uninstalled connected apps, which in turn affected the default Salesforce CLI connected app usage in these two ways.

OAuth 2.0 Device Flow is Blocked in the Default Salesforce CLI Connected App

Starting on 8/28/2025, new and existing authorizations to any org using the OAuth 2.0 Device Flow that also use the default Salesforce CLI connected app will be blocked.

For example, if you use the org login device CLI command with the default Salesforce CLI connected app, then starting on 8/28/2025 the authorization will be blocked.

We recommend that instead of the OAuth 2.0 Device Flow, you use a different OAuth 2.0 flow, such as:

• Web Server Flow: Authorize an org using a browser. CLI command: org login web.
• JWT Bearer Flow: Authorize an org in a headless environment, such as CI. CLI command: org login jwt.

See Prepare for Connected App Usage Restrictions Change for additional details.

NOTE: You can't work around this issue by installing the default Salesforce CLI connected app and enabling device flow, because the Enable for Device Flow option in the API (Enable OAuth Settings) section has been disabled. You must now be the org admin to install the Salesforce CLI connected app.

New Org Permission Required to Use the Default (Uninstalled) Salesforce CLI Connected App

As of September 2025, users can use uninstalled connected apps only if they have the new Approve Uninstalled Connected Apps user permission. Org administrators have this permission by default.

Because the default Salesforce CLI connected app is uninstalled by default, you must now also have the new user permission to use the connected app.

See Prepare for Connected App Usage Restrictions Change for additional details.