sf-connected-apps

Configure Salesforce Connected Apps by enabling PKCE, setting minimal OAuth scopes, enforcing refresh token rotation, and applying IP restrictions. This Skill automates app creation with built-in security validation across JWT Bearer, PKCE, and standard OAuth flows to reduce misconfiguration risks.

External Client Apps are the modern, more secure alternative to Connected Apps with enhanced OAuth 2.0 capabilities and stronger policy compliance. Migrate when you need improved security controls, better token management, and compliance with current Salesforce best practices for integrations.

This Skill validates OAuth configurations against 120-point security scoring across six categories, checking PKCE enforcement, token rotation policies, certificate management, and scope appropriateness. It flags compliance gaps and provides remediation guidance for single-org and multi-org deployments.

Yes. The Skill provides migration guidance and templates to upgrade existing Connected Apps to External Client Apps while maintaining current integrations. It assesses your configuration, identifies security gaps, and recommends deployment pathways for zero-downtime transitions.

This Skill supports JWT Bearer, PKCE, and standard OAuth flows tailored to your use case—API integrations, SSO, and mobile apps. Each flow includes app generation templates, pre-configured scopes, and security enforcement specific to your deployment context.

PKCE adds a dynamic cryptographic layer to OAuth that prevents authorization code interception attacks, critical for mobile apps where code can be exposed. This Skill enforces PKCE by default and validates its implementation across your OAuth configuration.