---
cuppy_hub: salesforce
cuppy_path: changelog/2026-10-22-orgs-and-access-family.md
cuppy_section: docs
cuppy_doc: 8CP9-J8P8
cuppy_doc_uuid: 86227dcf-58a2-4826-891c-77bb65906994
cuppy_permalink: https://cuppy.io/salesforce/d/8CP9-J8P8
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/salesforce/docs/changelog/2026-10-22-orgs-and-access-family
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 84d7981eb28c738d10e9d949ca2966af4d2a9edfac64af4ea360997160ae0bad
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Salesforce hub — family 1, Orgs, editions and API access (2026-10-22)

## What's in it

The hub card, START, the map, and these documents:

- `reference/orgs/orgs-and-editions.md`
- `reference/auth/external-client-apps-and-oauth-flows.md`
- `reference/auth/oauth-and-session-errors.md`
- `reference/access/users-permissions-and-agent-users.md`
- `guides/auth/server-to-server-from-typescript.md`

## 2026 changes captured

- **Data Cloud is now Data 360.** The Developer Edition includes Agentforce and Data 360, plus Agentforce Vibes and hosted MCP servers since April 2026.
- **New connected apps are restricted (Spring '26):** use External Client Apps. A Dev Hub that creates scratch orgs still needs a connected app.
- **The OAuth username-password flow retires on February 20, 2027**, and SOAP `login()` in Summer '27. jsforce's deprecation note points to the flow that is itself retiring.
- **`sf org create agent-user`** creates an agent's run-as user with the Einstein Agent User profile and the required permission sets.
- Winter '27 is API 68.0 ("preview" on Salesforce's docs); Spring '26 is 66.0.

## How it was checked

Sources:
- Salesforce developer docs and help pages by WebFetch, each with its date.
- Salesforce CLI 2.155.7 help, for every command and flag.
- `forcedotcom/sfdx-core` and `source-deploy-retrieve`, `salesforcecli/plugin-agent` and `plugin-auth`, `forcedotcom/agents`, and `trailheadapps/coral-cloud`, at pinned commits.

Checks:
- TypeScript compiles under `tsc --strict` with jsforce 3.12.0.
- The CLI sweep checks every `sf` command and flag against help.

## Found while building

- jsforce's `loginBySoap` deprecation message recommends the OAuth username-password flow, which Salesforce retires on February 20, 2027.
- jsforce still defaults to API version 50.0.
- Salesforce's SOAP end-of-life page labels 68.0 as Winter '27 in its version selector, but its support table stops at 66.0.

## Still missing

- Verbatim OAuth `error_description` strings from a Salesforce-hosted page. They come from vendor guides; Salesforce's help page didn't render them.
- External Client App metadata XML examples.
- Sandboxes and Hyperforce specifics.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 376 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/salesforce/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->