verapli
Sign inJoin free
Menu

Guides · commerce · Popular APIs

Salesforce External Client App (formerly connected app)

Create an External Client App in a Salesforce org to get an OAuth consumer key and secret. Creation of new connected apps is disabled by default from Spring '26; distributing a packaged app on AppExchange needs the AppExchange security review.

Researched · not yet run liveLast researched 25 October 2026 · Salesforce · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

The app lives in a Salesforce org (a free Developer Edition org works for building); AppExchange distribution needs ISV partner enrolment.

  • Salesforce org (e.g. Developer Edition) organisation
  • Salesforce Partner Community / ISV Partner Program developeroptionalOnly for AppExchange listings.

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Create an External Client App

    In Setup, Quick Find "External Client App Manager" > New External Client App. Enter basic info and contact email, enable OAuth, set the callback URL and OAuth scopes, then Create.

    • verapli co-pilot
    • Human step: You press submit
    If something goes wrong (2)
    • The "New Connected App" option is missing or blocked: New connected apps are disabled by default from Spring '26; create an External Client App instead (or ask Salesforce Support to enable connected-app creation). [1]
    • Login with the new app fails right after creation: Wait and retry; new apps can take some time to become available [to verify].

    Where: https://login.salesforce.com/

  2. Copy the consumer key and secret

    Open the app > Settings > OAuth Settings > Consumer Key and Secret, verify with the emailed code, then copy both.

    • verapli co-pilot
    • Human step: You enter a 2-step code
    • After: Create an External Client App

    verapli captures SALESFORCE_CONSUMER_SECRET here by plain code: encrypted in your browser, never shown to AI.

    Where: https://login.salesforce.com/

  3. AppExchange security review (only if distributing a package)optional

    Enrol in the ISV Partner Program, package the solution and submit for the AppExchange security review in the Partner Console.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Create an External Client App
    The provider says
    Up to 4 weeks after the submission is verified (verification 1-2 weeks) [to verify]. [4]

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

From Spring '26 new connected apps are disabled by default; guides showing "New Connected App" are outdated. [1]

Can cost moneyThe rules say

AppExchange security review fees applied per attempt for paid apps ($999 in 2023) [to verify current fee]. [5]

What you end up with

Env varSecretFormatWhat it is
SALESFORCE_CONSUMER_KEYnot secretopaque id stringOAuth consumer key (client ID)
SALESFORCE_CONSUMER_SECRETsecretopaque secret stringOAuth consumer secret
SALESFORCE_LOGIN_URLnot secrethttps://{mydomain}.my.salesforce.comLogin/instance base URL (login.salesforce.com, test.salesforce.com for sandboxes, or My Domain)

Pricing

  • Free tier: Developer Edition orgs are free [to verify].
  • AppExchange security review fee per attempt for paid apps [to verify current amount].

Source [5]

For agents

The same entry as JSON: /api/v1/entries/salesforce/connected-app · requirements /api/v1/requirements/salesforce/connected-app · terms /api/v1/terms/salesforce/connected-app.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Salesforce External Client App (formerly connected app), and how long will it take?"
  → tools/call requirements { "provider_id": "salesforce/connected-app" }

Sources

  1. Creation of New Connected Apps Is Disabled by Default Spring '26 release note: creating new connected apps is disabled by default in all orgs; existing connected apps keep working; contact Salesforce Support to enable creation; external client apps recommended. (Read via search summary; page did not render for direct fetch [to verify].) · accessed 25 October 2026 · official
  2. Create an External Client App in Your Org Setup > External Client App Manager > New External Client App; basic info, enable OAuth, callback URL, Create; Settings > OAuth Settings > Consumer Key and Secret (identity verification by email code). (Read via search summary [to verify].) · accessed 25 October 2026 · official
  3. External Client Apps and Connected Apps External client apps are the recommended replacement for connected apps [to verify detail]. · accessed 25 October 2026 · official
  4. How the AgentExchange Security Review Works Review takes up to 4 weeks after submission is verified; stages list 1-2 weeks to verify and 3-4 weeks first-time testing; duration depends on completeness and volume. (Read via search summary [to verify].) · accessed 25 October 2026 · official
  5. Prepare Your App to Pass the AppExchange Security Review Per-attempt security review fee ($999 per attempt for paid apps; none for free solutions) as of 2023 [to verify current]. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Salesforce is not affiliated with verapli.