JWT Token-Based Authentication for Orchestrate and Collaborate Integration

Orchestrate now sends a JWT access token, along with OrgId, UserName, UserId, timestamp, and a signature generated using a shared key, to the Collaborate endpoint /salesforce/new_document for document generation. Collaborate decrypts and validates the token and signature to authenticate Salesforce users, replacing the previous reliance on remote_sessionid. This update enhances security and aligns with Salesforce OAuth 2.0 JWT Bearer flow requirements for user authentication.

Public URL Expiry Functionality

We've introduced an important security enhancement to improve how public URLs of published proposals are accessed and shared. This update ensures that proposal links are no longer accessible indefinitely, helping protect your data from unauthorized access.

Previously, a public URL could be accessed by anyone who had the link (when an access code was not enabled) simply by entering any first name and last name. This posed a potential security risk.

• Public URLs will now automatically expire after a defined number of days from the publish date and result in a 403 error.

• Expired public URLs can be renewed.

• For all proposals published more than 30 days before the patch release date (April 13, 2026), public URLs will automatically expire immediately after deployment.

• For proposals published after the patch release:

  • Expiry is calculated based on Publish Date and Configured Public URL Expiry Extension, which is 30 days by default.

For more information, see Public URL Expiry Functionality.