{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"c9ae58680740885908c6d936cb59cb248ff6879d774bbe08237b50b8da480b3d","entry":{"id":"salesforce/connected-app","name":"Salesforce External Client App (formerly connected app)","vendor":"Salesforce","summary":"Create an External Client App in a Salesforce org to get an OAuth consumer key and secret. Creation of new connected apps is disabled by default from Spring '26; distributing a packaged app on AppExchange needs the AppExchange security review.","aliases":["salesforce/external-client-app"],"category":"commerce","group":"C","homepage":"https://developer.salesforce.com","docs":["https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_eca.htm","https://developer.salesforce.com/docs/platform/mobile-sdk/guide/connected-apps.html"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"ca_disabled","url":"https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_identity_connected_app_creation_disabled.htm&release=260&type=5","title":"Creation of New Connected Apps Is Disabled by Default","accessed":"2026-10-25","supports":"Spring '26 release note: creating new connected apps is disabled by default in all orgs; existing connected apps keep working; contact Salesforce Support to enable creation; external client apps recommended. (Read via search summary; page did not render for direct fetch [to verify].)","kind":"official"},{"id":"eca_create","url":"https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_eca.htm","title":"Create an External Client App in Your Org","accessed":"2026-10-25","supports":"Setup > External Client App Manager > New External Client App; basic info, enable OAuth, callback URL, Create; Settings > OAuth Settings > Consumer Key and Secret (identity verification by email code). (Read via search summary [to verify].)","kind":"official"},{"id":"eca_overview","url":"https://developer.salesforce.com/docs/platform/mobile-sdk/guide/connected-apps.html","title":"External Client Apps and Connected Apps","accessed":"2026-10-25","supports":"External client apps are the recommended replacement for connected apps [to verify detail].","kind":"official"},{"id":"secreview","url":"https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_how_it_works.htm","title":"How the AgentExchange Security Review Works","accessed":"2026-10-25","supports":"Review takes up to 4 weeks after submission is verified; stages list 1-2 weeks to verify and 3-4 weeks first-time testing; duration depends on completeness and volume. (Read via search summary [to verify].)","kind":"official"},{"id":"secreview_blog","url":"https://developer.salesforce.com/blogs/2023/04/prepare-your-app-to-pass-the-appexchange-security-review","title":"Prepare Your App to Pass the AppExchange Security Review","accessed":"2026-10-25","supports":"Per-attempt security review fee ($999 per attempt for paid apps; none for free solutions) as of 2023 [to verify current].","kind":"official"}],"allowed_domains":["salesforce.com","force.com"],"account_model":{"summary":"The app lives in a Salesforce org (a free Developer Edition org works for building); AppExchange distribution needs ISV partner enrolment.","accounts":[{"name":"Salesforce org (e.g. Developer Edition)","kind":"organisation","required":true},{"name":"Salesforce Partner Community / ISV Partner Program","kind":"developer","required":false,"note":"Only for AppExchange listings."}]},"steps":[{"id":"create_eca","title":"Create an External Client App","summary":"In Setup, Quick Find \"External Client App Manager\" > New External Client App. Enter basic info and contact email, enable OAuth, set the callback URL and OAuth scopes, then Create.","route":"copilot","depends_on":[],"gate":"human_submit","url":"https://login.salesforce.com/","recovery":[{"hiccup":"The \"New Connected App\" option is missing or blocked","fix":"New connected apps are disabled by default from Spring '26; create an External Client App instead (or ask Salesforce Support to enable connected-app creation).","source":"ca_disabled"},{"hiccup":"Login with the new app fails right after creation","fix":"Wait and retry; new apps can take some time to become available [to verify]."}],"sources":["eca_create","ca_disabled"]},{"id":"copy_consumer_key","title":"Copy the consumer key and secret","summary":"Open the app > Settings > OAuth Settings > Consumer Key and Secret, verify with the emailed code, then copy both.","route":"copilot","depends_on":["create_eca"],"gate":"2fa","url":"https://login.salesforce.com/","capture":{"env":"SALESFORCE_CONSUMER_SECRET","kind":"secret"},"sources":["eca_create"]},{"id":"appexchange_review","title":"AppExchange security review (only if distributing a package)","summary":"Enrol in the ISV Partner Program, package the solution and submit for the AppExchange security review in the Partner Console.","route":"guided","depends_on":["create_eca"],"gate":"third_party_review","lead_time":{"official":{"text":"Up to 4 weeks after the submission is verified (verification 1-2 weeks) [to verify].","source":"secreview"}},"optional":true}],"outputs":[{"name":"SALESFORCE_CONSUMER_KEY","description":"OAuth consumer key (client ID)","secret":false,"example_format":"opaque id string","from_step":"copy_consumer_key"},{"name":"SALESFORCE_CONSUMER_SECRET","description":"OAuth consumer secret","secret":true,"example_format":"opaque secret string","from_step":"copy_consumer_key"},{"name":"SALESFORCE_LOGIN_URL","description":"Login/instance base URL (login.salesforce.com, test.salesforce.com for sandboxes, or My Domain)","secret":false,"example_format":"https://{mydomain}.my.salesforce.com"}],"terms_notes":[{"kind":"rules_say","severity":"amber","text":"From Spring '26 new connected apps are disabled by default; guides showing \"New Connected App\" are outdated.","source":"ca_disabled"},{"kind":"rules_say","severity":"amber","text":"AppExchange security review fees applied per attempt for paid apps ($999 in 2023) [to verify current fee].","source":"secreview_blog"}],"pricing_notes":{"free_tier":"Developer Edition orgs are free [to verify].","notes":"AppExchange security review fee per attempt for paid apps [to verify current amount].","source":"secreview_blog"},"stripe_projects":false,"api_provisioning":{"available":"partial","notes":"External client apps can be deployed as metadata with Salesforce CLI [to verify]; consumer secret retrieval needs identity verification."}}}