skills.rest
amanpraaj
amanpraajCOMMUNITY
Explore all skills by this author →
GitHub

sf-connected-apps

Creates and validates Salesforce Connected Apps and External Client Apps with OAuth configuration templates.

1|Updated May 7, 2026
Search Tags:#oauth#metadata#salesforce#pkce#jwt bearer#connected app#external client app
One-click install
npx skills add https://github.com/amanpraaj/sf-skill-hub --skill sf-connected-apps-amanpraaj
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sf-connected-apps
Source: https://github.com/amanpraaj/sf-skill-hub/tree/main/skills/salesforce/sf-connected-apps
Command: npx skills add https://github.com/amanpraaj/sf-skill-hub --skill sf-connected-apps-amanpraaj

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve? Configuring Salesforce OAuth applications requires choosing between Connected Apps and External Client Apps, selecting the right OAuth flow, and avoiding security anti-patterns like wildcard callbacks or excessive scopes. This Skill generates correct metadata files from tested templates and scores configurations against a 120-point security checklist. ## Core Features & Use Cases - App Generation: Create Connected Apps or External Client Apps from XML templates covering basic, OAuth, JWT bearer, and canvas patterns. - Security Scoring: Validate existing apps across 6 categories (security, OAuth config, metadata compliance, best practices, scopes, documentation) totaling 120 points. - Migration Support: Step-by-step guidance for migrating Connected Apps to External Client Apps with credential rollover planning. - Use Case: A DevOps engineer needs a JWT bearer Connected App for a GitHub Actions CI/CD pipeline; the Skill generates the certificate-based metadata file with admin pre-approval and zero refresh token policy. ## Quick Start Use the sf-connected-apps skill to create an External Client App named FieldServiceMobile with PKCE enabled and Api, RefreshToken, and OpenID scopes.

Frequently Asked Questions about sf-connected-apps

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a Salesforce Connected App for OAuth integration?▼

Start from the connected-app-oauth.xml template and replace placeholders for app name, contact email, and callback URL. Choose minimal scopes like Api and RefreshToken, then deploy with sf project deploy start targeting your org.

Connected App vs External Client App: which should I use?▼

Use a Connected App for simple single-org integrations needing legacy compatibility. Choose an External Client App for multi-org distribution, 2GP packaging, automated secret rotation, or enhanced audit logging. Note that new Connected App creation is disabled by default in Spring '26 orgs.

How do I set up JWT bearer flow for Salesforce CI/CD?▼

Generate an X.509 certificate, upload it to Salesforce Certificate and Key Management, then use the connected-app-jwt.xml template referencing that certificate name. Pre-authorize the integration user via a Permission Set and set refreshTokenPolicy to zero.

Why does my External Client App deployment fail with invalid field errors?▼

ECA OAuth settings require commaSeparatedOauthScopes as a single string, not individual scopes tags, and every companion file must include externalClientApplication and label fields. Also verify file suffixes: use .ecaGlblOauth and .ecaPlcy, not the unabbreviated forms.

Does Salesforce support PKCE for mobile app OAuth?▼

Yes, PKCE is supported and required for public clients like mobile apps and SPAs. Set isPkceRequired to true and isConsumerSecretOptional to true in the ECA global OAuth settings, and use a custom scheme callback URL such as myapp://oauth/callback.

When should I not use this skill for Salesforce authentication?▼

Do not use it for Named Credentials or runtime callout configuration, which belongs to integration setup, or for Apex token-handling code. It also does not handle permission policy assignments or metadata deployment to orgs, which are delegated to other skills.

Related Skills

Explore More Software Engineering Skills→
padjeipadjei

integration-connectivity-connected-app-configure

Configure Salesforce Connected Apps and External Client Apps with OAuth flows and security scoring.

Community
Advanced
forcedotcomforcedotcom
803

configuring-connected-apps

Generate and validate Salesforce OAuth metadata for Connected Apps and External Client Apps.

Official
Advanced
starwreckntxstarwreckntx

Access Control Agent

Enforce RBAC/ACL policies and audit permissions for least privilege.

Community
Basic
jiten-singh-shahijiten-singh-shahi
13

sf-integration

Implement Salesforce Apex REST and SOAP callouts with Named Credentials and retry logic.

Community
Advanced