Table of Contents
- Executive Summary
- The Problem with Connected Apps at Scale
- The Modern Solution: External Client Apps & Managed Packages
- Architecture Overview
- OAuth Scopes & Security Configuration
- How the Managed Package Works
- Customer Experience: Before & After
- Use Cases & Target Customers
- Salesforce Deprecation Timeline & Compliance
- Engagement Options
- Implementation Approach
- Frequently Asked Questions
1. Executive Summary
The Challenge: Companies that integrate with Salesforce currently require every customer to manually create and manage their own Connected App, OAuth credentials, callback URLs, and security configuration. This creates onboarding friction, inconsistent environments, support overhead, and long-term maintenance risk.
The Solution: Salesforce’s External Client Application framework, combined with 2nd-generation managed packages (2GP), allows a single pre-configured OAuth application to be distributed to any number of customer orgs via a simple install URL. Customers install the package and get a fully configured, security-compliant authentication setup without manual configuration.
The Outcome: Reduced onboarding time, eliminated configuration errors, centralized OAuth management, PKCE-compliant security, and a scalable architecture that supports hundreds or thousands of customer orgs from a single package.
Onboarding Steps
OAuth Configuration
All Customers
2. The Problem with Connected Apps at Scale
Most Salesforce integrations today rely on Connected Apps for OAuth authentication. While this works for simple, single-org integrations, it introduces significant problems when deployed across multiple customer orgs.
Current State: What Goes Wrong
Onboarding Friction
- Every customer must create a Connected App manually
- They must configure OAuth scopes correctly
- They must set the right callback URL(s)
- They must share the Consumer Key and Secret securely
- Any misconfiguration causes integration failures
Ongoing Maintenance Risk
- Customers can accidentally modify OAuth settings
- Credential rotation requires coordination
- No visibility into customer-side configuration
- Security policies vary across orgs
- Salesforce deprecation timelines create migration burden
Salesforce has been actively transitioning away from legacy Connected App patterns. External Client Applications are the recommended path forward for ISVs and SaaS integrations. Organizations that do not modernize face increasing compatibility risk with each Salesforce release.
The Real Cost of Per-Customer Connected Apps
| Area | Impact | Who Bears the Cost |
|---|---|---|
| Initial setup documentation & support | Support tickets on every new customer onboarding | Your team + Customer admin |
| Misconfigured callback URLs | Integration failures, delayed go-live | Customer admin + Your support |
| Wrong OAuth scopes selected | Partial functionality, data access errors | Customer admin |
| Credential management | Security risk from shared secrets via email/chat | Both parties |
| Salesforce updates & deprecations | Every customer must update their own Connected App | Customer admin |
| Security audit & compliance | No centralized visibility into authentication state | Your compliance team |
3. The Modern Solution: External Client Apps & Managed Packages
Salesforce introduced External Client Applications as a modern replacement for Connected Apps in integration scenarios. When combined with 2nd-generation managed packages (2GP), they provide a fundamentally better architecture.
Before: Connected App Model
- Customer creates Connected App
- Customer configures OAuth scopes
- Customer sets callback URLs
- Customer shares credentials with you
- Customer manages lifecycle & security
- Every org is different
After: External Client App Model
- Customer installs a managed package (one click)
- OAuth scopes are pre-configured
- Callback URLs are centrally managed
- No credential sharing required
- You control the configuration
- Every org is identical
Key Advantages
| Capability | Connected App | External Client App (Packaged) |
|---|---|---|
| Customer setup required | 15-30 minute manual configuration | One-click package install |
| OAuth scope management | Customer-configured (error-prone) | Publisher-defined (locked down) |
| Callback URL control | Customer-managed | Publisher-managed via package |
| Credential handling | Manual sharing of Consumer Key/Secret | No manual credential exchange |
| PKCE support | Optional, often not implemented | Built-in, enforced by default |
| Cross-org consistency | No guarantee | 100% identical configuration |
| Version management | No versioning | Full package versioning & upgrades |
| Customer can break config | Yes | No (managed package protection) |
4. Architecture Overview
High-Level Flow
MANAGED PACKAGE DISTRIBUTION MODEL
Package Publisher
External Client App
+ OAuth Settings
Installs Package
Installs Package
Installs Package
What the Package Contains
| Component | Metadata Type | Purpose |
|---|---|---|
| External Client Application | ExternalClientApplication |
Defines the OAuth client app identity, contact info, and distribution state. Scoped to the publisher org so all subscriber orgs reference the same app definition. |
| OAuth Settings | ExtlClntAppOauthSettings |
Pre-configures OAuth scopes (API, Web, RefreshToken, OpenID, Basic). Links to the publisher org’s OAuth configuration. |
| Configurable Policies | ExtlClntAppOauthConfigurablePolicies |
Controls which settings (if any) the subscriber admin can customize post-install, such as IP relaxation or refresh token policies. |
OAuth Authentication Flow (Post-Install)
PKCE-COMPLIANT OAUTH 2.0 FLOW
Customer Org
Initiates OAuth + PKCE
Authorization Server
Token returned
Pre-configured in Pkg
+ PKCE Verification
5. OAuth Scopes & Security Configuration
The managed package pre-configures the following OAuth scopes, ensuring every customer org has exactly the permissions your integration requires:
| Scope | Purpose | Why It’s Needed |
|---|---|---|
| Api | Access Salesforce REST & SOAP APIs | Core data read/write operations. Required for any integration that queries or modifies Salesforce data. |
| Web | Web-based OAuth flow | Enables the standard browser-based OAuth authorization code flow used by SaaS applications. |
| RefreshToken | Offline access via refresh tokens | Allows the integration to maintain long-lived sessions without requiring the user to re-authenticate repeatedly. |
| OpenID | OpenID Connect identity | Provides user identity information (who is the logged-in user) for SSO and identity verification. |
| Basic | Basic user profile info | Access to basic profile fields (name, email) needed for user identification in the integration. |
Security Features
The External Client App architecture supports Proof Key for Code Exchange (PKCE), which eliminates the risk of authorization code interception attacks. Unlike legacy Connected Apps where PKCE is optional, External Client Apps can enforce PKCE by default, aligning with OAuth 2.1 best practices and Salesforce’s security direction.
What the Customer Cannot Modify
Because the External Client App is distributed via a managed package, the following are protected from customer-side changes:
- OAuth scopes (cannot add or remove scopes)
- Callback URL(s) (centrally managed by the publisher)
- Core app identity and client credentials
- Distribution state and app metadata
This means customers cannot accidentally break the OAuth integration by modifying settings they do not fully understand.
What the Customer Can Control
Through Salesforce’s standard admin controls, customers retain governance over:
- Which users/profiles have access to the app (via Permission Sets or Profiles)
- IP restrictions at the org level
- Session timeout policies
- User-level OAuth consent requirements
6. How the Managed Package Works
Package Distribution Model
The External Client App is created in the publisher’s Dev Hub org and packaged using Salesforce’s 2nd-generation packaging (2GP). This creates an installable package URL that any Salesforce org can use.
Customer Installation Process
-
Receive the Install URL
Customer receives a Salesforce package installation URL (e.g.,
login.salesforce.com/packaging/installPackage.apexp?p0=04t...) - Click Install Customer admin logs into their Salesforce org and clicks “Install” to add the package. They choose whether to install for all users or specific profiles.
- Package Deploys Automatically The External Client App and its OAuth settings are automatically created in the customer’s org with the correct configuration. No manual setup required.
- Authorize & Connect The customer navigates to the SaaS application and initiates the OAuth flow. Salesforce recognizes the packaged External Client App and presents the standard authorization consent screen.
- Integration Is Live Upon authorization, the integration is fully operational. The OAuth token is issued with the correct scopes, and API communication begins.
Package Upgrades
If OAuth configuration changes are needed in the future (e.g., adding new scopes, updating callback URLs), the publisher creates a new package version and customers install the upgrade. This provides a controlled, versioned update path rather than ad-hoc manual changes across customer orgs.
7. Customer Experience: Before & After
Before: Legacy Connected App Onboarding
- Read setup documentation (5-10 pages) Customer admin must understand OAuth concepts, find the Connected App setup page, and follow step-by-step instructions.
- Create Connected App in Salesforce Setup Navigate to Setup → App Manager → New Connected App. Fill in application name, contact email, and enable OAuth.
- Configure OAuth scopes correctly Select the right combination of scopes from a long list. Easy to select wrong scopes or miss required ones.
- Enter the correct callback URL(s) Copy-paste callback URLs from documentation. Typos or trailing slashes cause silent failures.
- Share Consumer Key & Secret Securely transmit credentials. Often sent via email or chat, creating security risk.
- Debug configuration issues Troubleshoot OAuth errors caused by misconfiguration. Multiple support tickets are common.
After: Managed Package Onboarding
- Click the install link One URL. One click. Done.
- Authorize in the SaaS application Standard Salesforce OAuth consent screen. User clicks “Allow.”
A process that previously required a Salesforce administrator with OAuth knowledge, 30+ minutes of configuration time, and often resulted in support tickets is reduced to two clicks that any admin can complete.
8. Use Cases & Target Customers
This solution is relevant to any company that integrates with multiple Salesforce orgs and currently requires customers to create their own Connected Apps.
SaaS Platforms
Multi-tenant SaaS products that connect to each customer’s Salesforce org for data sync, reporting, or workflow automation. The managed package eliminates per-customer OAuth setup and reduces onboarding time.
Salesforce ISV Partners
AppExchange partners or ISVs building products that need OAuth access to subscriber orgs. The External Client App can be bundled with the existing managed package or distributed separately.
Enterprise Integration Platforms
Companies with iPaaS or middleware products that connect to Salesforce. Standardizing authentication across all customer connections reduces support burden and improves security posture.
Data & Analytics Products
BI tools, data warehouses, or analytics platforms that pull data from Salesforce. Pre-configured OAuth means faster time-to-value and fewer data pipeline failures from auth issues.
Ideal Customer Profile
| Criteria | Details |
|---|---|
| Number of Salesforce customer connections | 10+ customer orgs (higher count = greater ROI) |
| Current authentication method | Per-customer Connected Apps with manual setup |
| Onboarding pain | Support tickets related to OAuth setup or misconfiguration |
| Security requirements | Need for PKCE, credential management improvements, or audit compliance |
| Product type | SaaS, ISV, integration platform, or data product with Salesforce integration |
9. Salesforce Deprecation Timeline & Compliance
Salesforce is actively evolving its authentication and authorization framework. Understanding the direction helps position this modernization as both a competitive advantage and a compliance necessity.
Key Trends
- External Client Apps as the standard: Salesforce recommends External Client Applications for all new integrations, especially those distributed across multiple orgs.
- PKCE becoming mandatory: The industry-wide shift toward OAuth 2.1 makes PKCE a requirement rather than an option. Salesforce is aligning with this direction.
- Connected App limitations: While Connected Apps are not immediately deprecated, they lack the packaging, distribution, and lifecycle management features of External Client Apps.
- Managed package distribution: 2GP packaging for authentication components provides version control, upgrade paths, and subscriber management that Connected Apps cannot offer.
Companies that modernize now will be ahead of the curve when Salesforce tightens requirements around authentication standards. Those still relying on manually configured Connected Apps across multiple orgs will face a larger, more costly migration later.
Compliance Benefits
| Requirement | Connected App | External Client App (Packaged) |
|---|---|---|
| PKCE enforcement | Optional, inconsistent | Supported & enforceable |
| Credential exposure risk | High (manual sharing) | Eliminated |
| Configuration audit | Must inspect each org individually | Guaranteed by package version |
| SOC 2 / ISO 27001 alignment | Difficult to demonstrate consistency | Centralized control, verifiable |
10. Engagement Options
We offer flexible engagement models depending on the scope and complexity of the modernization effort.
Assessment
Understand your current state
- Audit existing Connected App configurations
- Identify migration candidates
- Security gap analysis
- Recommendation report with prioritized roadmap
Implementation
Build & deploy the solution
- Everything in Assessment, plus:
- External Client App creation & configuration
- Managed package build & testing
- OAuth flow integration with your application
- PKCE implementation
- Customer install URL & documentation
- Pilot rollout to initial customer orgs
Ongoing Support
Maintain & evolve
- Package version management
- OAuth scope updates
- Salesforce release compatibility
- Customer org troubleshooting
- Security compliance monitoring
11. Implementation Approach
12. Frequently Asked Questions
What happens to existing Connected Apps?
Existing Connected Apps continue to work. The migration is additive — customers install the new package and begin using the External Client App for authentication. Once validated, the old Connected App can be deactivated. There is no forced cutover.
Can customers modify the OAuth settings after installation?
No. Because the External Client App is delivered via a managed package, the core OAuth settings (scopes, callback URLs, app identity) are controlled by the package publisher. Customers cannot accidentally modify or break the configuration. They retain control over user access policies and profile-level permissions.
What if different customers need different callback URLs?
In most SaaS architectures, the callback URL points to the SaaS platform (e.g., https://app.yourproduct.com/oauth/callback), which is the same for all customers. The customer-specific context is handled via state parameters in the OAuth flow, not via different callback URLs. For multi-region deployments, multiple callback URLs can be configured in a single External Client App.
Does this work with Salesforce Sandbox environments?
Yes. The managed package can be installed in both production and sandbox orgs. Sandbox installations use test.salesforce.com as the authorization endpoint but the same package and External Client App configuration.
How does this affect AppExchange listing?
External Client Apps are fully compatible with AppExchange distribution. If you already have a managed package on AppExchange, the External Client App can be added to the existing package. If you are building a standalone authentication package, it can be listed independently.
Is this approach suitable for server-to-server (JWT) flows?
External Client Apps primarily target user-interactive OAuth flows (authorization code + PKCE). For server-to-server integrations using JWT Bearer flow, a hybrid approach may be needed. We can assess your specific requirements and recommend the right architecture.
What Salesforce editions support this?
External Client Applications and managed package installation are supported in Enterprise, Unlimited, Performance, and Developer editions. Professional Edition has limitations on API access that may affect the integration regardless of the authentication method used.












