To follow recommended security standards, use the new credentials Connect REST API resource instead of Metadata API to access External Client App OAuth consumer credentials.
Where: This change applies Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.
When: Salesforce enforces this update in Winter ‘25. To get the major release upgrade date for your instance, go to Trust Status, search for your instance, and click the maintenance tab.
Who: This change applies to existing External Client App users who use Metadata API to access consumer credentials.
Why: Accessing consumer secrets through the credentials endpoint of the Connect REST API removes the possibility of accidentally committing consumer secrets to source control.
How: Access consumer secrets through the credentials endpoint of the Connect REST API. Unless you contact Salesforce Customer Support to continue using Metadata API, your external client apps can’t access consumer secrets via Metadata API after Winter ’25.