Salesforce Apex 68

Apply these rules to Apex classes and triggers compiled at API 68.0 on Salesforce's Winter '27 platform, including Apex REST, Lightning and Visualforce controllers, invocable actions, and asynchronous jobs. Check the API version of every class and trigger involved; an org upgrade does not make older code use this scope's defaults.

Platform and entry points

• Treat the Apex runtime as Salesforce-managed. Check the org's available API versions and official retirement notices when selecting a supported compilation scope; test behavior changes before changing class or trigger metadata. Audit installed packages and local build dependencies separately in CI, and never lower an existing security or version constraint to make deployment succeed.
• Expose only the methods the application needs through @AuraEnabled, @RestResource, webservice, or @InvocableMethod. Grant Apex class access through narrowly scoped permission sets.
• Check the caller's right to perform the operation and access each supplied record inside the method. Class access, a visible button, and a Flow or agent choosing an action are not operation-level permission.
• Derive the principal from the authenticated Salesforce context. Treat request parameters, deserialized objects, Flow inputs, record IDs, and action arguments as untrusted; a supplied user ID or account ID must not choose whose authority is used.

Authentication and tokens

• Use Salesforce authentication or an established identity provider for password storage and login; do not collect or store Salesforce passwords in application data.