Salesforce hub — family 1, Orgs, editions and API access (2026-10-22)

The first Salesforce hub release — orgs for Agentforce work (Developer Edition with Agentforce and Data 360, scratch org features, My Domain, API versions), External Client Apps and OAuth flows with the Agent API's scopes, the username-password and SOAP login() retirements, integration, Run As and agent users, the OAuth and session error catalogue, and a TypeScript guide for client credentials and JWT bearer.

markdownreferencev18CP9-J8P8area: changelogchangelogrelease notesorgs and access family

Created 23 Oct 2026 · Modified 23 Oct 2026 · 1 version

What's in it

The hub card, START, the map, and these documents:

  • reference/orgs/orgs-and-editions.md
  • reference/auth/external-client-apps-and-oauth-flows.md
  • reference/auth/oauth-and-session-errors.md
  • reference/access/users-permissions-and-agent-users.md
  • guides/auth/server-to-server-from-typescript.md

2026 changes captured

  • Data Cloud is now Data 360. The Developer Edition includes Agentforce and Data 360, plus Agentforce Vibes and hosted MCP servers since April 2026.
  • New connected apps are restricted (Spring '26): use External Client Apps. A Dev Hub that creates scratch orgs still needs a connected app.
  • The OAuth username-password flow retires on February 20, 2027, and SOAP login() in Summer '27. jsforce's deprecation note points to the flow that is itself retiring.
  • sf org create agent-user creates an agent's run-as user with the Einstein Agent User profile and the required permission sets.
  • Winter '27 is API 68.0 ("preview" on Salesforce's docs); Spring '26 is 66.0.

How it was checked

Sources:

  • Salesforce developer docs and help pages by WebFetch, each with its date.
  • Salesforce CLI 2.155.7 help, for every command and flag.
  • forcedotcom/sfdx-core and source-deploy-retrieve, salesforcecli/plugin-agent and plugin-auth, forcedotcom/agents, and trailheadapps/coral-cloud, at pinned commits.

Checks:

  • TypeScript compiles under tsc --strict with jsforce 3.12.0.
  • The CLI sweep checks every sf command and flag against help.

Found while building

  • jsforce's loginBySoap deprecation message recommends the OAuth username-password flow, which Salesforce retires on February 20, 2027.
  • jsforce still defaults to API version 50.0.
  • Salesforce's SOAP end-of-life page labels 68.0 as Winter '27 in its version selector, but its support table stops at 66.0.

Still missing

  • Verbatim OAuth error_description strings from a Salesforce-hosted page. They come from vendor guides; Salesforce's help page didn't render them.
  • External Client App metadata XML examples.
  • Sandboxes and Hyperforce specifics.

Read this document as markdown — the same bytes an agent receives.