Salesforce Connected Apps: Complete Guide
Quick Summary:
A Connected App defines how an external application authenticates with and accesses your Salesforce org via OAuth. Any third-party integration touching your data typically needs one.
What Is a Connected App?
A Connected App is Salesforce's mechanism for controlling how an external application -- a custom integration, a third-party tool, a mobile app -- authenticates and what it's permitted to access. It defines the OAuth scopes, callback URLs, and security policies governing that specific integration.
⚠️ Before You Start
Treat the Consumer Secret with the same care as a password. Anyone with the Consumer Key and Secret can potentially authenticate as your Connected App, so these credentials should never be committed to source control or shared insecurely.
How to Create One
Go to Setup → App Manager → New Connected App.
Fill in basic information (name, contact email) and enable OAuth Settings.
Set the callback URL that matches exactly what the external application expects.
Select the OAuth scopes the integration actually needs (avoid granting broader access than necessary).
Save, then note the generated Consumer Key and Secret for use in the external application's configuration.
Optionally restrict access to specific profiles or permission sets under Manage → Edit Policies.
A Real-World Example
A company builds a custom mobile app that needs to read and update Opportunity data on behalf of field sales reps. A Connected App, configured with the specific OAuth scopes needed (and nothing broader), lets the mobile app authenticate as each individual rep, ensuring the app only ever sees data that rep already has legitimate access to.
🚫 Common Mistake
Granting overly broad OAuth scopes "just in case" rather than the minimum the integration actually needs. Every scope granted is additional exposure if the Consumer Secret is ever compromised -- least-privilege access is worth the extra setup consideration.
💡 Pro Tip
Regularly review Connected App OAuth Usage in Setup, especially for integrations built by former employees or vendors no longer engaged -- unused or forgotten Connected Apps are a genuine, often-overlooked security surface.
Frequently Asked Questions
What\'s the difference between a Connected App and an External Client App?
External Client Apps are Salesforce's newer, more secure app framework separating app configuration from org-specific credentials; Connected Apps are the traditional model, still widely used and fully supported.
Do I need a Connected App for every external integration?
Generally yes, for any external system authenticating via OAuth -- the Connected App defines what that system is allowed to access and how it authenticates.
What\'s a callback URL and why does it matter?
The callback URL is where Salesforce redirects after successful authentication during the OAuth flow -- it must exactly match what the external application expects, or authentication will fail.
Can I restrict which users can use a Connected App?
Yes, via profile or permission set assignment on the Connected App, letting you control exactly which users' credentials can be used through that integration.
What\'s the difference between Consumer Key and Consumer Secret?
The Consumer Key (Client ID) identifies the app publicly; the Consumer Secret is a confidential credential that must be protected -- treat it with the same care as a password.
Can a Connected App use digital signatures instead of a secret?
Yes, for certain OAuth flows (like JWT bearer), a Connected App can be configured to use a digital certificate instead of a shared secret, which some security teams prefer.
Why is my Connected App integration suddenly failing after a Salesforce release?
Salesforce periodically enforces security updates affecting Connected Apps (like requiring specific OAuth scopes or flows) -- check Setup → Connected Apps OAuth Usage and recent release notes when this happens.
Can I monitor how a Connected App is actually being used?
Yes, Connected App OAuth Usage in Setup shows which users are authenticating through a given app and when, useful for auditing and troubleshooting.
Do Connected Apps expire?
OAuth tokens issued through a Connected App can expire or be revoked based on session and refresh token policies; the Connected App configuration itself doesn't expire on its own.
Can I delete a Connected App that\'s actively being used?
You can, but doing so immediately breaks any integration relying on it -- always confirm nothing production-critical depends on a Connected App before deleting it.