skills.rest
forcedotcom
forcedotcomOFFICIAL
Explore all skills by this author →
Website𝕏@salesforcedevsGitHub

configuring-connected-apps

Generate and validate Salesforce OAuth metadata for Connected Apps and External Client Apps.

803|289|Updated Nov 7, 2025
Search Tags:#external client apps#connected apps#pkce#security scoring#salesforce oauth#jwt bearer#eca metadata
One-click install
npx skills add https://github.com/forcedotcom/sf-skills --skill configuring-connected-apps
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: configuring-connected-apps
Source: https://github.com/forcedotcom/sf-skills/tree/main/skills/configuring-connected-apps
Command: npx skills add https://github.com/forcedotcom/sf-skills --skill configuring-connected-apps

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

Configuring Salesforce OAuth correctly—especially across Connected Apps and External Client Apps (ECAs)—is error-prone and security-sensitive, and missteps can break authentication or expose credentials.

Core Features & Use Cases

  • Connected Apps & ECAs Setup: Generate and configure OAuth app metadata for Salesforce integration use cases, including server-to-server and user-interactive flows.
  • OAuth Flow Selection & Configuration: Guide the right flow choice (Authorization Code, PKCE, JWT Bearer, Device Flow, Client Credentials) and apply the correct metadata templates.
  • Security Scoring & Guardrails: Provide a 120-point validation approach with best-practice defaults like least-privilege scopes, explicit callback URLs, PKCE for public clients, and rotation-ready strategies.
  • Migration Support: Assist with Connected App → ECA migration planning and mapping, including retrieval-first requirements for certain ECA security settings.
  • Deployment Readiness & Error Handling: Validate file naming/suffix conventions and surface common failure causes like duplicate apps, cross-reference mismatches, and insufficient permissions.

Quick Start

Use configuring-connected-apps to create an External Client App named "MobileApp" with PKCE enabled for a mobile client that needs Api and RefreshToken scopes.

Frequently Asked Questions about configuring-connected-apps

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure a Salesforce Connected App with PKCE for a mobile client?▼

To configure a Salesforce Connected App with PKCE, you select the Authorization Code flow and enforce PKCE for public mobile clients, applying least-privilege Api and RefreshToken scopes to generate secure OAuth metadata.

What is the difference between Connected Apps and External Client Apps in Salesforce OAuth?▼

Connected Apps and External Client Apps (ECAs) both manage Salesforce OAuth metadata, but ECAs require a retrieval-first approach for certain security settings and support specific migration mapping from Connected App configurations.

When should I use a JWT Bearer flow instead of Authorization Code for Salesforce integrations?▼

Use the JWT Bearer flow for server-to-server Salesforce integrations where unattended authentication is required, whereas Authorization Code with PKCE suits user-interactive clients needing secure delegated access.

Why does my Salesforce OAuth deployment fail with duplicate app or cross-reference errors?▼

Salesforce OAuth deployment failures with duplicate app or cross-reference errors occur when file naming conventions and suffixes are mismatched; validating deployment readiness and explicit metadata references resolves these issues.

How do I migrate from a Connected App to an External Client App in Salesforce?▼

Migrating from a Connected App to an External Client App requires retrieval-first mapping of existing security settings, translating OAuth companion settings and headers into ECA metadata templates with strict naming conventions.

What security scoring checks should I apply when hardening Salesforce OAuth configurations?▼

Security scoring for Salesforce OAuth applies a 120-point validation checking least-privilege scopes, explicit callback URLs, PKCE enforcement for public clients, and rotation-ready strategies to harden configurations.

Related Skills

Explore More Software Engineering Skills→
JaganproJaganpro
423

sf-connected-apps

Configure Salesforce Connected Apps and External Client Apps with OAuth security policies.

Community
Intermediate
paulanunes85paulanunes85
1

validation-scripts

Automate pre- and post-deployment validation checks with Bash and Python scripts.

Community
Advanced
salesforce-miscsalesforce-misc
4

datakit-metadata-deploy

Deploy Data360 Retail Data Kit metadata components to a Salesforce org using Salesforce CLI.

Official
Advanced
padjeipadjei

integration-connectivity-connected-app-configure

Automate OAuth flow, JWT bearer, and Connected App configuration in Salesforce.

Community
Advanced