- Public apps must switch from non‑expiring to expiring offline access tokens by Jan 1 2027 or be delisted and blocked from new installs.
- New client‑credentials flow lets back‑ends obtain short‑lived tokens via signed requests without a refresh token.
- Non‑compliant apps face incremental penalties: warnings Jan 15 2027; 403 errors on affected API calls after Apr 1 2027.