{"slug":"salesforce","name":"Salesforce","domain":"salesforce.com","category":"CRM","summary":"You can connect your own org through an External Client App (ECA) in under an hour. Letting any customer's org connect is harder. Since Spring '26 you can't create new Connected Apps by default, so you have to ship your ECA in a second-generation (2GP) managed package. Each customer org then installs that package, or its admin approves your app. Salesforce doesn't review the app unless you want an AppExchange listing.","tier":"self-serve","tierReason":"No Salesforce review is needed before other orgs can connect, but you must package and distribute the ECA yourself, and each customer org's admin controls whether it can be used. The AppExchange security review applies only if you want a public listing.","quality":"generated","updatedAt":"2026-10-27","composio":{"status":"managed","note":"Composio has a managed Salesforce OAuth app, so you can prototype before building your own ECA. Customer orgs may still need their admin to approve or install that app, and your name won't be on the consent screen until you use your own.","toolkit":"SALESFORCE"},"totals":{"effort":{"min":1,"max":3,"unit":"days"},"wait":{"min":0,"max":0,"unit":"days"},"firstConnection":"Today, in about 30–60 minutes, using a free Developer Edition org and a Local ECA"},"stages":[{"id":"build","name":"Your org","whoCanConnect":"Users of the org where you created a Local External Client App","userSees":"The standard Salesforce login, then an 'Allow Access' consent screen showing your app name and scopes","effort":{"min":30,"max":90,"unit":"minutes"},"wait":{"min":0,"max":0,"unit":"minutes"},"unlock":"Create a Packaged ECA, put it in a 2GP managed package and promote a released version","evidence":{"kind":"community","sources":["s3","s8"],"confidence":"medium"}},{"id":"launch","name":"Customer orgs","whoCanConnect":"Users in any Salesforce org that has installed your managed package and whose policies let users self-authorize","userSees":"The Salesforce login and consent screen. Before that, an admin installs your package from its install URL, or from AppExchange if you're listed.","effort":{"min":1,"max":3,"unit":"days"},"wait":{"min":0,"max":0,"unit":"days"},"unlock":null,"evidence":{"kind":"community","sources":["s3","s4","s5"],"confidence":"medium"}}],"requirements":[{"id":"sf-org","label":"Salesforce org with ECA permission","detail":"ECAs are available in Professional, Performance, Unlimited and Developer editions. A free Developer Edition org works. Your user needs the 'Create, Edit, and Delete External Client Apps' permission.","stage":"build","actor":"you","evidence":{"kind":"community","sources":["s3"],"confidence":"medium"}},{"id":"https-redirect","label":"Redirect URI","detail":"The callback URL of your OAuth client, which you enter on the ECA.","stage":"build","actor":"agent","evidence":{"kind":"community","sources":["s3","s8"],"confidence":"high"}},{"id":"devhub-namespace","label":"Dev Hub org and namespace org","detail":"Packaging needs a Dev Hub plus a separate org that registers a namespace. One org can't do both. The Dev Hub must stay alive for as long as the package is used, because it holds the global OAuth settings.","stage":"launch","actor":"you","evidence":{"kind":"community","sources":["s3","s4"],"confidence":"medium"}},{"id":"sf-cli","label":"Salesforce CLI","detail":"You use the Salesforce CLI to create the 2GP package and its package versions.","stage":"launch","actor":"agent","evidence":{"kind":"community","sources":["s3"],"confidence":"medium"}},{"id":"customer-admin","label":"Customer admin cooperation","detail":"Each customer org's admin has to install your package. Otherwise users need the 'Approve Uninstalled Connected Apps' or 'Use Any API Client' permission before they can authorize an app that isn't installed.","stage":"launch","actor":"you","evidence":{"kind":"community","sources":["s6","s13"],"confidence":"medium"}}],"steps":[{"id":"get-org","title":"Sign up for a Developer Edition org","actor":"you","stage":"build","time":{"min":10,"max":20,"unit":"minutes"},"detail":"Create a free Developer Edition org, or use an org you already have in a supported edition. Make sure your user can create External Client Apps.","agentNote":"A person has to sign up and verify the email address.","gotcha":"Nango's guide reports invalid_client_id errors when the developer user's password contains special characters.","link":{"label":"Salesforce Developer signup","url":"https://developer.salesforce.com/signup"},"evidence":{"kind":"community","sources":["s3"],"confidence":"medium"}},{"id":"create-eca","title":"Create an External Client App","actor":"agent","stage":"build","time":{"min":15,"max":30,"unit":"minutes"},"detail":"In Setup, open External Client App Manager and create a new app. Choose Local for single-org testing, or Packaged if you will distribute it. Enable OAuth and enter your redirect URI.","actions":["Setup > Quick Find 'External Client App Manager' > New External Client App","Fill in the app name, API name and contact email","Distribution State: Local (testing) or Packaged (multi-org)","Enable OAuth; Callback URL = your redirect URI","Scopes: 'Manage user data via APIs (api)' and 'Perform requests at any time (refresh_token, offline_access)'","Enable the Authorization Code and Credentials flow; leave 'Require secret' and 'Require PKCE' on","Policies tab: Refresh Token Policy = valid until revoked"],"agentNote":"An agent can fill in this form once a person is signed in. A person should copy the consumer secret.","gotcha":"New Connected Apps are disabled by default since Spring '26. Don't follow older guides that tell you to create one in App Manager.","link":{"label":"Salesforce login","url":"https://login.salesforce.com"},"evidence":{"kind":"community","sources":["s3","s8","s2"],"confidence":"medium"}},{"id":"copy-creds","title":"Copy consumer key and secret into your client","actor":"you","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Open the app's Settings tab, reveal the Consumer Key and Consumer Secret, and store them in your OAuth client. Use https://login.salesforce.com/services/oauth2/authorize and /token, or test.salesforce.com for sandboxes.","agentNote":"An agent can set the key and endpoints. A person handles the secret.","gotcha":"Every customer org has its own instance_url, which comes back in the token response. Store it for each connection.","evidence":{"kind":"community","sources":["s3"],"confidence":"medium"}},{"id":"test-connection","title":"Test a connection with your own org","actor":"agent","stage":"build","time":{"min":10,"max":20,"unit":"minutes"},"detail":"Run the authorization code flow, approve access, and call an API endpoint using the returned instance_url.","agentNote":"An agent can run the test. A person signs in.","gotcha":"Changes to ECA settings may take a few minutes to apply.","evidence":{"kind":"inferred","sources":[],"confidence":"low"}},{"id":"setup-packaging","title":"Set up a Dev Hub and register a namespace","actor":"you","stage":"launch","time":{"min":1,"max":3,"unit":"hours"},"detail":"Enable Dev Hub in one org, register a namespace in a separate org, and link the namespace to the Dev Hub in Namespace Registries.","agentNote":"An agent can click through Setup once a person is signed in to both orgs.","gotcha":"You can't enable Dev Hub and register a namespace in the same org.","evidence":{"kind":"community","sources":["s3"],"confidence":"medium"}},{"id":"package-eca","title":"Package the Packaged ECA in a 2GP package","actor":"agent","stage":"launch","time":{"min":2,"max":8,"unit":"hours"},"detail":"Create the ECA in the Dev Hub with Distribution State set to Packaged. Then use the CLI to create a managed package, retrieve the ECA metadata, create a package version and promote it to released. Leave the global OAuth settings out of the package and keep them in the Dev Hub.","actions":["sf org login web (Dev Hub)","sf package create --package-type Managed","Retrieve the ECA metadata; set the namespace and package ID in sfdx-project.json","sf package version create, then sf package version promote"],"agentNote":"An agent can run the CLI commands once a person has authenticated the CLI.","gotcha":"One community report says a packaged ECA failed in subscriber orgs with OAUTH_AUTHORIZATION_BLOCKED 'Cross-org OAuth flows are not supported'. Check how the OAuth link is configured in an installed test org before you launch.","evidence":{"kind":"community","sources":["s3","s4","s5"],"confidence":"medium"}},{"id":"distribute","title":"Give customers the package install URL","actor":"you","stage":"launch","time":{"min":30,"max":60,"unit":"minutes"},"detail":"Send customers' admins the install URL and ask them to set the app's policy so users can self-authorize. Install it in a second test org first to confirm that OAuth works across orgs.","agentNote":"An agent can test in a second org once a person is signed in.","gotcha":"Users in orgs that haven't installed the app are blocked unless they hold the Approve Uninstalled Connected Apps or Use Any API Client permission.","evidence":{"kind":"community","sources":["s3","s6"],"confidence":"medium"}},{"id":"appexchange-optional","title":"Optionally submit for AppExchange security review","actor":"you","stage":"launch","time":null,"detail":"You need this only for a public AppExchange listing. Older Salesforce docs list a $2,550 review fee plus a $150 listing fee for paid solutions, and no fee for free ones.","agentNote":"Joining the partner program, paying and submitting have to be done by a person.","gotcha":"The fees above come from older doc versions, so check the current Packaging Guide.","evidence":{"kind":"docs","sources":["s9","s10"],"confidence":"low"}}],"blockers":[{"symptom":"You can't create a Connected App, or the option is missing in App Manager","cause":"Since Spring '26, creating new Connected Apps is disabled by default in every org, both in the UI and through the API","fix":"Use an External Client App. Salesforce Support can grant a temporary exception, but Salesforce has said it will remove that option.","evidence":{"kind":"community","sources":["s2","s7","s11"],"confidence":"high"}},{"symptom":"Users in a customer org get blocked at authorization because the app isn't installed","cause":"Since September 2025, users need the Approve Uninstalled Connected Apps or Use Any API Client permission to authorize apps that aren't installed","fix":"Have the customer admin install your package or app, or grant that permission to the users who connect","evidence":{"kind":"community","sources":["s6","s13"],"confidence":"medium"}},{"symptom":"OAUTH_AUTHORIZATION_BLOCKED: Cross-org OAuth flows are not supported for this external client app","cause":"Unclear. One community reply points to how the global OAuth settings and the OAuth link are set up on the packaged ECA.","fix":"Make sure the subscriber ECA refers to the source org's global OAuth settings, and keep the source org alive. If it still fails, contact Salesforce support.","evidence":{"kind":"community","sources":["s5"],"confidence":"low"}}],"unknowns":[{"question":"Does a packaged ECA support cross-org web-server OAuth with one consumer key out of the box?","why":"The only community thread on this has no confirmed fix, and the official docs returned 403 to the fetcher","resolve":"Install your package in a second Developer Edition org and test, or read help.salesforce.com 'External Client Apps' packaging docs"},{"question":"Do the uninstalled-app permission rules apply to ECAs the same way they apply to Connected Apps?","why":"The sources only discuss Connected Apps","resolve":"Test with an org that hasn't installed your package, and check Salesforce help"},{"question":"What are the current AppExchange security review fees and turnaround times?","why":"Only older doc versions were found, with no timeline","resolve":"Check the latest ISVforce/Packaging Guide or ask your Partner Account Manager"}],"handoff":{"agentCan":["Fill in the ECA form and OAuth settings","Configure your OAuth client with the consumer key and endpoints","Run CLI packaging commands after a person authenticates","Test connections in your own org and in test orgs"],"youMust":["Sign up for and sign in to the Salesforce orgs","Copy and store the consumer secret","Register a namespace and enable Dev Hub","Get customer admins to install the package","Pay for and submit the AppExchange security review if you want a listing"]},"sources":[{"id":"s1","title":"Composio managed auth toolkits","url":"https://docs.composio.dev/toolkits/managed-auth.md","publisher":"Composio docs","kind":"composio","checkedAt":"2026-10-27"},{"id":"s2","title":"Salesforce connected apps and external client apps","url":"https://striim.com/docs/en/salesforce-connected-apps-and-external-client-apps.html","publisher":"Striim docs","kind":"community","checkedAt":"2026-10-27"},{"id":"s3","title":"Salesforce API OAuth app setup","url":"https://nango.dev/docs/api-integrations/salesforce/salesforce-api-oauth-app-setup.md","publisher":"Nango docs","kind":"community","checkedAt":"2026-10-27"},{"id":"s4","title":"Package and distribute external client apps","url":"https://trailhead.salesforce.com/content/learn/modules/external-client-app-basics/package-and-distribute-external-client-apps","publisher":"Salesforce Trailhead","kind":"official","checkedAt":"2026-10-27"},{"id":"s5","title":"Cross-org OAuth blocked for packaged ECA","url":"https://trailhead.salesforce.com/pt-BR/trailblazer-community/feed/0D5KX00000pNxl60AC","publisher":"Trailblazer Community","kind":"community","checkedAt":"2026-10-27"},{"id":"s6","title":"Salesforce Connected App Security Changes","url":"https://www.soliantconsulting.com/blog/salesforce-connected-app-security-changes-sept2025/","publisher":"Soliant Consulting","kind":"community","checkedAt":"2026-10-27"},{"id":"s7","title":"New Connected Apps Can No Longer Be Created in Spring '26","url":"https://help.salesforce.com/s/articleView?id=005228017&type=1","publisher":"Salesforce Help","kind":"search","checkedAt":null},{"id":"s8","title":"Create an External Client App","url":"https://developer.salesforce.com/docs/platform/mobile-sdk/guide/eca-create.html","publisher":"Salesforce Developers","kind":"search","checkedAt":"2026-10-27"},{"id":"s9","title":"Security review fees","url":"https://developer.salesforce.com/docs/atlas.en-us.230.0.packagingGuide.meta/packagingGuide/security_review_fees.htm","publisher":"Salesforce Developers","kind":"search","checkedAt":null},{"id":"s10","title":"How the AppExchange Security Review Submission Loop Works","url":"https://tekunda.com/blog/How-the-AppExchange-Security-Review-Submission-Loop-Works","publisher":"Tekunda","kind":"search","checkedAt":null},{"id":"s11","title":"Connected Apps (Packaging Guide)","url":"https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/connected_apps.htm","publisher":"Salesforce Developers","kind":"search","checkedAt":"2026-10-27"},{"id":"s13","title":"Salesforce connected app usage restrictions","url":"https://docs.movedata.io/troubleshooting/connection-and-authentication/salesforce-connected-app-usage-restrictions/","publisher":"MoveData docs","kind":"search","checkedAt":null}],"feedback":{}}