Maintain Your Heroku Architect Certification for Summer ’26

Learning Objectives

After completing this unit, you’ll be able to:

Explain how to configure and manage the GitHub Enterprise Server integration for Heroku Enterprise.
Describe the modernization improvements introduced in Heroku CLI v11.0.
Define how increased slug size limits support modern Heroku application deployments.
Illustrate how query string redaction improves log security in Heroku.
Identify how Heroku AppLink securely connects Heroku apps with Salesforce and CI/CD workflows.

Stay Current with Your Certification

Salesforce certifications hold the most value when you keep them relevant. To keep your Heroku architect certification current, complete this badge by the due date.

Interested in learning more about getting certified? Check out the Heroku architect certification.

While anyone can earn this badge, it is designed for those who hold the Heroku architect certification.

As part of the Salesforce Certification Program, you agree to the terms of the Salesforce Certification Program Agreement. Review the exam policies in the agreement and the Salesforce Certification Program Agreement and Code of Conduct article before you continue.

Heroku Architect Certification Overview

As a Heroku architect, you deliver the best value when you:

Build automated deployment pipelines that accelerate delivery while maintaining quality and reliability.
Design applications that scale efficiently and support increasingly complex workloads, including AI-powered solutions.
Implement security and compliance controls that protect sensitive data and support enterprise governance requirements.
Use modern platform tools and operational capabilities to improve developer productivity and application management.
Connect Heroku applications seamlessly with Salesforce and related platforms to deliver integrated customer and employee experiences.

This badge highlights key updates that you need to know for Heroku architect Summer ’26 to keep your certification current and your skills sharp.

Configure GitHub Enterprise Server Integration for Heroku Enterprise

Heroku Enterprise customers can integrate GitHub Enterprise Server with Heroku using a GitHub App–based integration. This approach provides stronger security and governance than the legacy OAuth-based GitHub integration because the GitHub app operates independently of individual user accounts and supports more granular repository permissions.

Before enabling the integration, ensure that:

You have manage permissions for the Heroku Enterprise account.
You have full access to the GitHub Enterprise Server organization that contains the repositories to be used with Heroku.
GitHub’s expiring user access tokens feature is disabled.

All repositories used across the Enterprise account must reside within the same GitHub organization.

Because the integration changes how Heroku connects to GitHub, organizations should test the feature with a dedicated Enterprise team before enabling it across the entire Enterprise account. To begin, contact Heroku Support and request that they enable GitHub Enterprise Server integration for your Enterprise account or a designated test team.

After the feature is enabled, configure the integration by completing the following steps.

Open the Enterprise Account’s Settings tab.
In the GitHub Enterprise Server section, select Connect.
Enter the GitHub Enterprise Server URL and the name of the GitHub organization that contains your repositories.
Select Connect to begin the GitHub App installation process.
When redirected to GitHub Enterprise Server, provide a name for the GitHub app and select Create GitHub App.
Choose whether the GitHub app can access all repositories or only a specified set of repositories.
Select Install & Authorize.

After installation is complete, the Enterprise account is linked to the selected GitHub organization, and the connected organization appears in the Enterprise account settings.

If your account is already connected to a GitHub Enterprise Server org, you can connect an individual app to a repo on it.

For an individual app, open the app's Deploy tab and connect the appropriate GitHub Enterprise Server repository.
For a pipeline, open the pipeline's Settings tab and connect the repository using the new GitHub Enterprise Server integration.

After the integration is enabled, all new apps and pipelines created within the Enterprise account (or enabled Enterprise teams) use the GitHub Enterprise Server integration rather than the legacy OAuth-based GitHub integration.

Keep in mind that there is no simple rollback path. Uninstalling the integration disconnects all associated apps and pipelines, and administrators must manually reconnect repositories if they choose to return to the legacy OAuth-based GitHub integration.

Key limitations include the requirement to disable GitHub’s expiring user access tokens feature, the lack of support for GitHub organizations that enforce IP-based access restrictions, and the 1:1 relationship between a Heroku Enterprise account and a GitHub organization.

Use Heroku CLI v11.0 for Modernized Development Workflows

Heroku CLI v11.0 introduces a major modernization update designed to improve performance, usability, and developer productivity. This release upgrades the Heroku CLI architecture with newer platform technologies and enhanced command-line capabilities that support more efficient development and operational workflows.

The Heroku CLI now runs on Node.js 22, converts the codebase to ECMAScript Modules (ESM), and upgrades to oclif v4 to improve command execution speed and the overall developer experience.

This release also introduces several new features, including a semantic color system for improved command-line readability and a new `heroku search` command for command discovery.

Together, these updates modernize the Heroku CLI experience and help developers work more efficiently across Heroku application management tasks. Read more about Heroku CLI 11.0 in the changelog.

Support Larger Applications with Increased Slug Size Limits

As applications continue to grow in complexity, deployment packages often grow with them. To support modern workloads, Heroku increased the default maximum compressed slug size from 500 MB to 1 GB. This enables organizations to more easily deploy applications with larger dependency sets, AI and machine learning frameworks, and enterprise-scale architectures.

A slug is the compressed application package created during deployment and distributed to dynos for execution. During the build process, Heroku compiles application code, installs dependencies, and packages the final slug archive. Heroku also enforces build constraints, including a 25-minute build timeout and approximately 12 GB of memory available during compilation.

For applications that require even larger deployments, organizations can request an increase to 2 GB by opening a Heroku Support ticket.

While larger slug limits provide greater flexibility, architects should still optimize deployments whenever possible. Best practices include:

Use a .slugignore file to exclude unnecessary files such as documentation, test assets, and local resources.
Store large static assets, datasets, videos, or media files in external services such as Amazon S3 rather than packaging them in the slug.
Manage dependencies carefully to reduce package size.
Purge build caches when troubleshooting build performance or cache-related issues.

When you understand slug size limits and deployment optimization strategies you can design scalable applications that build faster, start more efficiently, and support increasingly sophisticated AI-enabled workloads on Heroku.

Protect Sensitive Data with Query Parameter Log Redaction

Heroku provides query string redaction for router logs through the http-router-no-log-query feature. This capability helps organizations protect sensitive information by preventing query parameters from being exposed in router logs that are forwarded to external log drains.

When the feature is enabled, the Heroku Router automatically strips query strings from incoming URLs before sending data to external log drains. Instead of displaying the original query parameters, the router replaces them with a REDACTED label.

For example, consider the following request URL:

/search?email=user@example.com&token=abc123

Without query string redaction enabled, router logs include the full query string:

2026-04-26T16:58:32.943253+00:00 heroku[router]: at=info method=GET path="/search?email=user@example.com&token=abc123" host=my-app.example.com request_id=6903a168-b79b-ec27-03c8-b8f64d8d8792 fwd=203.0.113.50  dyno=web.1 connect=0ms service=0ms status=200 bytes=0

With query string redaction enabled, the router removes the query parameters from the logged path:

2026-04-26T16:58:32.943253+00:00 heroku[router]: at=info method=GET path="/search?REDACTED" host=my-app.example.com request_id=6903a168-b79b-ec27-03c8-b8f64d8d8792 fwd=203.0.113.50  dyno=web.1 connect=0ms service=0ms status=200 bytes=0

Administrators can enable the feature for an application using the Heroku CLI:

heroku features:enable http-router-no-log-query -a <your-app-name>

After the feature is enabled, query strings are automatically redacted from router logs sent to external log drains. This helps organizations reduce the risk of exposing sensitive data such as tokens, identifiers, or personal information through logging systems.

This feature is supported in both Common Runtime and Private Spaces environments.

Securely Connect Heroku Apps with Salesforce Using AppLink

Modern applications often span multiple platforms, which makes secure integration essential. Heroku AppLink helps organizations connect Heroku applications directly to Salesforce by exposing Heroku APIs as services that can be consumed by Salesforce technologies such as Flow, Apex, Data Cloud, and Agentforce.

AppLink provides a standardized approach for extending Salesforce with custom functionality built on Heroku while maintaining centralized security and governance controls. Developers can build services on Heroku and make them available throughout the Salesforce ecosystem–which means they can create connected application experiences without requiring custom integration frameworks.

To support secure automation, AppLink includes enhanced JWT authorization for headless authentication. This capability enables CI/CD systems, deployment pipelines, and other automated processes to authenticate securely with Salesforce without requiring interactive user logins. With token-based authentication, organizations can automate integrations and adhere to security best practices.

AppLink also supports external clients, which allow applications and services outside of Salesforce to securely access AppLink-managed APIs. This expands integration options and maintains consistent authentication and authorization controls across connected systems.

For governance and compliance, AppLink provides audit trail tracking for Enterprise accounts to help administrators monitor integration activity and maintain visibility into access patterns and configuration changes.

Recent enhancements to the AppLink Dashboard also improve the management experience by providing clearer visibility into connected services, authorization settings, and integration configuration details. These updates make it easier for administrators and architects to monitor and manage AppLink connections across their Heroku and Salesforce environments.

AppLink provides an out-of-the-box framework that lets Heroku architects build secure, scalable integrations between Heroku, Salesforce, Data Cloud, Agentforce, and external applications and supports enterprise security and compliance requirements.

Sum It Up

Building and operating modern applications requires more than just deploying code. It requires automation, security, scalability, and seamless connectivity. This release introduces enhancements across the Heroku platform that help organizations meet those demands, from streamlined GitHub-driven deployments and a modernized CLI experience to support for larger, AI-powered application workloads. New security features help protect sensitive information in logs, while AppLink makes it easier to connect Heroku applications with Salesforce, Data Cloud, and Agentforce. Together, these updates give architects the tools to create more efficient development workflows, strengthen governance, and deliver connected enterprise experiences at scale.

Time Estimate

Topics

Looking for Help?

Heroku Resources