integration-connectivity-connected-app-configure

Name: integration-connectivity-connected-app-configure
Author: forcedotcom

1.8kinstalls272forks

How to install integration-connectivity-connected-app-configure?

forcedotcom/sf-skills/integration-connectivity-connected-app-configure

$npx -y skills add forcedotcom/sf-skills --skill integration-connectivity-connected-app-configure

Installs into the current project.

Summary

Salesforce Connected Apps and External Client Apps OAuth configuration with 120-point scoring. Use this skill to configure OAuth flows, JWT bearer auth, Connected Apps, and External Client Apps in Salesforce. TRIGGER when: user configures OAuth flows, JWT bearer auth, Connected A

Files · 1

View on GitHub

SKILL.md

1	# integration-connectivity-connected-app-configure: Salesforce Connected Apps & External Client Apps
2
3	Use this skill when the user needs OAuth app configuration in Salesforce: Connected Apps, External Client Apps (ECAs), JWT bearer setup, PKCE decisions, scope design, or migration from older Connected App patterns to newer ECA patterns.
4
5	## Scope
6
7	In scope:
8	- `.connectedApp-meta.xml` or `.eca-meta.xml` files
9	- OAuth flow selection and callback / scope setup
10	- JWT bearer auth, device flow, client credentials, or auth-code decisions
11	- Connected App vs External Client App architecture choices
12	- Consumer key / secret / certificate handling strategy
13
14	Out of scope — delegate elsewhere:
15	- Configuring Named Credentials or runtime callouts → [integration-connectivity-generate](../integration-connectivity-generate/SKILL.md)
16	- Deploying metadata to orgs → [platform-metadata-deploy](../platform-metadata-deploy/SKILL.md)
17	- Writing Apex token-handling code → [platform-apex-generate](../platform-apex-generate/SKILL.md)
18
19	---
20
21	## First Decision: Connected App or External Client App
22
23	\| If the need is... \| Prefer \|
24	\|---\|---\|
25	\| simple single-org OAuth app \| Connected App \|
26	\| new development with better secret handling \| External Client App \|
27	\| multi-org / packaging / stronger operational controls \| External Client App \|
28	\| straightforward legacy compatibility \| Connected App \|
29
30	Default guidance:
31	- Choose ECA for new regulated, packageable, or automation-heavy solutions.
32	- Choose Connected App when simplicity and legacy compatibility matter more.
33	- Spring '26 note: creation of new Connected Apps is disabled by default in orgs. For new integrations, prefer External Client Apps unless Connected App compatibility is explicitly required.
34
35	---
36
37	## Required Inputs
38
39	Ask for or infer:
40	- App type: Connected App or ECA
41	- OAuth flow: auth code, PKCE, JWT bearer, device, client credentials
42	- Client type: confidential vs public
43	- Callback URLs / redirect surfaces
44	- Required scopes
45	- Distribution model: local org only vs packageable / multi-org
46	- Whether certificates or secret rotation are required
47
48	---
49
50	## Workflow
51
52	### 1. Choose the app model
53	Decide whether a Connected App or ECA is the better long-term fit using the decision table above.
54
55	### 2. Choose the OAuth flow
56
57	\| Use case \| Default flow \|
58	\|---\|---\|
59	\| backend web app \| Authorization Code \|
60	\| SPA / mobile / public client \| Authorization Code + PKCE \|
61	\| server-to-server / CI/CD \| JWT Bearer \|
62	\| device / CLI auth \| Device Flow \|
63	\| service account style app \| Client Credentials (typically ECA) \|
64
65	### 3. Start from the right template
66	Read the appropriate template before generating — do not build from scratch:
67
68	\| Template \| Use case \|
69	\|---\|---\|
70	\| `assets/connected-app-basic.xml` \| Simple API integration, minimal OAuth \|
71	\| `assets/connected-app-oauth.xml` \| Web app with full OAuth 2.0 configuration \|
72	\| `assets/connected-app-jwt.xml` \| JWT bearer / server-to-server \|
73	\| `assets/connected-app-canvas.xml` \| Embedding external apps in Salesforce UI (Canvas) \|
74	\| `assets/external-client-app.xml` \| ECA header file — all new ECA builds start here \|
75	\| `assets/eca-global-oauth.xml` \| ECA global OAuth settings (scopes, PKCE, rotation) \|
76	\| `assets/eca-oauth-settings.xml` \| ECA per-app OAuth settings \|
77	\| `assets/eca-policies.xml` \| ECA configurable policies \|
78
79	If you need source-controlled ECA OAuth security metadata, retrieve it from an org first and treat the retrieved file as the schema source of truth:
80	```sh
81	sf project retrieve start --metadata ExtlClntAppOauthSecuritySettings:<AppName> --target-org <alias>
82	```
83
84	### 4. Apply security hardening
85	Read `references/security-checklist.md` for the full 120-point security checklist. Favor:
86	- Least-privilege scopes
87	- Explicit callback URLs
88	- PKCE for public clients
89	- Certificate-based auth where appropriate
90	- Rotation-ready secret / key handling
91	- IP restrictions when realistic and maintainable
92
93	### 5. Validate deployment readiness
94	Read `references/testing-validation-guide.md` before handoff. Confirm:
95	- Metadata file naming is correct (see Gotchas below)
96	- Scopes are justified
97	- Callback and auth model match the real client type
98	- Secrets are not embedded in source
99
100	### 6. Handle errors

People who liked this also viewed

6 picks

Type

integration-connectivity-connected-app-configure

1.8kinstalls272forks

View on GitHub

How to install integration-connectivity-connected-app-configure?

forcedotcom/sf-skills/integration-connectivity-connected-app-configure

$npx -y skills add forcedotcom/sf-skills --skill integration-connectivity-connected-app-configure

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# integration-connectivity-connected-app-configure: Salesforce Connected Apps & External Client Apps
2
3	Use this skill when the user needs OAuth app configuration in Salesforce: Connected Apps, External Client Apps (ECAs), JWT bearer setup, PKCE decisions, scope design, or migration from older Connected App patterns to newer ECA patterns.
4
5	## Scope
6
7	In scope:
8	- `.connectedApp-meta.xml` or `.eca-meta.xml` files
9	- OAuth flow selection and callback / scope setup
10	- JWT bearer auth, device flow, client credentials, or auth-code decisions
11	- Connected App vs External Client App architecture choices
12	- Consumer key / secret / certificate handling strategy
13
14	Out of scope — delegate elsewhere:
15	- Configuring Named Credentials or runtime callouts → [integration-connectivity-generate](../integration-connectivity-generate/SKILL.md)
16	- Deploying metadata to orgs → [platform-metadata-deploy](../platform-metadata-deploy/SKILL.md)
17	- Writing Apex token-handling code → [platform-apex-generate](../platform-apex-generate/SKILL.md)
18
19	---
20
21	## First Decision: Connected App or External Client App
22
23	\| If the need is... \| Prefer \|
24	\|---\|---\|
25	\| simple single-org OAuth app \| Connected App \|
26	\| new development with better secret handling \| External Client App \|
27	\| multi-org / packaging / stronger operational controls \| External Client App \|
28	\| straightforward legacy compatibility \| Connected App \|
29
30	Default guidance:
31	- Choose ECA for new regulated, packageable, or automation-heavy solutions.
32	- Choose Connected App when simplicity and legacy compatibility matter more.
33	- Spring '26 note: creation of new Connected Apps is disabled by default in orgs. For new integrations, prefer External Client Apps unless Connected App compatibility is explicitly required.
34
35	---
36
37	## Required Inputs
38
39	Ask for or infer:
40	- App type: Connected App or ECA
41	- OAuth flow: auth code, PKCE, JWT bearer, device, client credentials
42	- Client type: confidential vs public
43	- Callback URLs / redirect surfaces
44	- Required scopes
45	- Distribution model: local org only vs packageable / multi-org
46	- Whether certificates or secret rotation are required
47
48	---
49
50	## Workflow
51
52	### 1. Choose the app model
53	Decide whether a Connected App or ECA is the better long-term fit using the decision table above.
54
55	### 2. Choose the OAuth flow
56
57	\| Use case \| Default flow \|
58	\|---\|---\|
59	\| backend web app \| Authorization Code \|
60	\| SPA / mobile / public client \| Authorization Code + PKCE \|
61	\| server-to-server / CI/CD \| JWT Bearer \|
62	\| device / CLI auth \| Device Flow \|
63	\| service account style app \| Client Credentials (typically ECA) \|
64
65	### 3. Start from the right template
66	Read the appropriate template before generating — do not build from scratch:
67
68	\| Template \| Use case \|
69	\|---\|---\|
70	\| `assets/connected-app-basic.xml` \| Simple API integration, minimal OAuth \|
71	\| `assets/connected-app-oauth.xml` \| Web app with full OAuth 2.0 configuration \|
72	\| `assets/connected-app-jwt.xml` \| JWT bearer / server-to-server \|
73	\| `assets/connected-app-canvas.xml` \| Embedding external apps in Salesforce UI (Canvas) \|
74	\| `assets/external-client-app.xml` \| ECA header file — all new ECA builds start here \|
75	\| `assets/eca-global-oauth.xml` \| ECA global OAuth settings (scopes, PKCE, rotation) \|
76	\| `assets/eca-oauth-settings.xml` \| ECA per-app OAuth settings \|
77	\| `assets/eca-policies.xml` \| ECA configurable policies \|
78
79	If you need source-controlled ECA OAuth security metadata, retrieve it from an org first and treat the retrieved file as the schema source of truth:
80	```sh
81	sf project retrieve start --metadata ExtlClntAppOauthSecuritySettings:<AppName> --target-org <alias>
82	```
83
84	### 4. Apply security hardening
85	Read `references/security-checklist.md` for the full 120-point security checklist. Favor:
86	- Least-privilege scopes
87	- Explicit callback URLs
88	- PKCE for public clients
89	- Certificate-based auth where appropriate
90	- Rotation-ready secret / key handling
91	- IP restrictions when realistic and maintainable
92
93	### 5. Validate deployment readiness
94	Read `references/testing-validation-guide.md` before handoff. Confirm:
95	- Metadata file naming is correct (see Gotchas below)
96	- Scopes are justified
97	- Callback and auth model match the real client type
98	- Secrets are not embedded in source
99
100	### 6. Handle errors

People who liked this also viewed

6 picks

Type