VerifiedResearched 2026-10-28Confidence medium

Salesforce

Salesforce · www.salesforce.com · Developer portal

Tier 2 · Self-serve, optional reviewCustomer-side gate

Salesforce does not approve your app. Each customer admin must install your managed package. Security review is only for AgentExchange, Group or Professional orgs without the API add-on, or removing the install notice.

sourced

inferred

sourced

Customer-side gate: The customer admin installs your package, picks who may use it, and sets the refresh token policy. With API Access Control on, only allowlisted apps work, with no user bypass since late 2025.

App types (3)

External Client App, Local: Prototype. Only users of your own org can connect.
External Client App, Packaged (2GP): Production. Each customer admin installs your package and sets its policies.
Connected App (legacy): Only if you have one. New ones need Salesforce Support since Spring '26. Uninstalled ones are blocked for most users since September 2025.

Docs read(reached)
Endpoints probed(reached)
Portal checked(not reached)
Set up by a person(not reached)

Evidence: 0 tested, 3 probed, 28 sourced, 3 inferred

Generate a live guide to compare with this one.

Next step

Create a free org at developer.salesforce.com/signup. You land in Setup with a My Domain like yourname-dev-ed.develop.my.salesforce.com.

https://developer.salesforce.com/signup

0 of 13

What does your agent need?

Select everything it does. Scopes decide the tier.

2Your tier: Self-serve, optional reviewAny user can connect. Review applies only to a public listing or higher limits.

Start today

Composio-managed OAuth: Yes

sourced

Composio offers managed OAuth for Salesforce, so you can start without your own app. A customer admin may need to approve or install Composio's app first. Private Salesforce subdomains need your own app. If you switch auth configs, only new connections use it. Existing users keep theirs until they re-authenticate.

Time and effort

You can build while you wait.

Stage	Who can connect	Hands-on	Waiting	Review
Prototype	Users of your own Developer Edition org. sourced External client apps are local by default. A Local app can be used only in the context of its own org. A Packaged app can be added to a second-generation (2GP) managed package and distributed. Connected apps, by contrast, were globally available by default. Trailhead: Use External Client Apps When Connected Apps Won't Do sourced · official docs · 2026-10-28 sourced API access is on by default in Enterprise, Performance, Unlimited, and Developer Edition orgs. Professional Edition needs a paid add-on. Calls to an org without API access fail with API_DISABLED_FOR_ORG. Each user also needs the API Enabled permission. Supported Editions and Required Permissions sourced · official docs · 2026-10-28 sourced You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days. Create an External Client App in Your Org sourced · official docs · 2026-10-28	2 h to 5 h	none	No
Limited beta	Design partner orgs whose admin installed your package. sourced OAuth consumer credentials of an ECA are global settings. They are not packaged but stored in a long-lived org that exists for the life of all package versions. A subscriber org can share the original app's consumer credentials or the app can generate new credentials there; configuring credentials locally breaks the association. Trailhead: Package and Distribute External Client Apps sourced · official docs · 2026-10-28 sourced To package an ECA you create a managed 2GP with Salesforce CLI from a Salesforce DX project, using a Dev Hub org with a namespace prefix. The Dev Hub owns the package and the namespace cannot be changed. Default policies you set show on the distributed app and the customer's admins can edit them. Package the External Client App for Canvas sourced · official docs · 2026-10-28 sourced When a managed package has not been authorized by the ISV Partner Program (never reviewed, under review, or failed), customers see a notice during installation and must confirm they understand it is not authorized before installing. Install Notifications for Unauthorized Managed Packages Page sits in the first-generation packaging guide. The second-generation guide has the same text (e31). sourced · official docs · 2026-10-28 sourced A third-party integration guide for multi-tenant SaaS uses a Packaged ECA: enable Dev Hub (irreversible), register a namespace in a separate org and link it, create the ECA with Distribution State Packaged, retrieve its metadata, run sf package version create, and send customers the install URL. Nango: Salesforce OAuth app setup sourced · community · 2026-10-28	8 h to 20 h	unknown	No
Production	Any customer org with API access that installs your package. sourced API access is on by default in Enterprise, Performance, Unlimited, and Developer Edition orgs. Professional Edition needs a paid add-on. Calls to an org without API access fail with API_DISABLED_FOR_ORG. Each user also needs the API Enabled permission. Supported Editions and Required Permissions sourced · official docs · 2026-10-28 sourced API access is not normally available in Group and Professional Edition orgs. After your app passes security review you can request an API token or REST allowlisting so your app can use the standard SOAP and REST APIs there. Bulk API 2.0 stays unavailable. API Access in Group and Professional Editions sourced · official docs · 2026-10-28 sourced Managed packages and API solutions must pass security review to be distributed on AgentExchange (Salesforce's marketplace; older pages and partners call it AppExchange). Salesforce's typical times: 1 to 2 weeks to verify the submission, 3 to 4 weeks for the first test, 2 to 3 weeks to retest a resubmission. Free solutions pay no fee. How the AgentExchange Security Review Works sourced · official docs · 2026-10-28 sourced A Salesforce security review consultancy says there is no fixed review SLA, first-time submitters often need two or three round trips, and common findings are CRUD/FLS gaps, missing sharing declarations, test orgs whose MFA blocks reviewers, and secrets stored in the wrong place. Tekunda: How ISVs pass the AppExchange security review sourced · community · 2026-10-28 sourced For each paid solution, Salesforce asks for a $999 fee for the initial security review submission and for each later attempt, paid by card or bank account in the Partner Console. Most submissions pass on the second attempt. Trailhead: Guide to Submitting Your Solution for Security Review sourced · official docs · 2026-10-28	4 h to 12 h	Provider says: 28 to 42 daysDevelopers report: unknown	No

Prototype: Developer Edition is free. A Local app does not work in other orgs.
Limited beta: No Salesforce wait. The work is packaging. The real wait is each customer's approval to install a third-party package, which we could not measure.
Production: Unlisted distribution has no Salesforce wait. An AgentExchange listing takes a stated 4 to 6 weeks (1 to 2 to verify, 3 to 4 to test), plus 2 to 3 weeks per resubmission. Most pass on the second attempt; a consultancy says first-timers often need two or three. Our estimate if you list: 2 to 4 months.

Scopes

Scopes that match your selection are marked.

Sign-in and identityNo review · Read data
openid profile email id
No review. Cannot read CRM data.
probed
Salesforce publishes an OpenID Connect discovery document at login.salesforce.com. It lists S256 as the only PKCE method and 39 scopes, including offline_access and refresh_token.
login.salesforce.com OIDC discovery
HTTP 200, JSON. authorization_endpoint and token_endpoint on login.salesforce.com.
probed · probe · 2026-10-28
sourced
You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days.
Create an External Client App in Your Org
sourced · official docs · 2026-10-28
Read and write CRM dataNo review · Read data, Write data
api
No review. Limited to the user's own Salesforce permissions.
sourced
You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days.
Create an External Client App in Your Org
sourced · official docs · 2026-10-28
sourced
API access is on by default in Enterprise, Performance, Unlimited, and Developer Edition orgs. Professional Edition needs a paid add-on. Calls to an org without API access fail with API_DISABLED_FOR_ORG. Each user also needs the API Enabled permission.
Supported Editions and Required Permissions
sourced · official docs · 2026-10-28
Background accessNo review · Act while offline
refresh_token offline_access
No review. The admin's refresh token policy sets how long access lasts.
sourced
You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days.
Create an External Client App in Your Org
sourced · official docs · 2026-10-28
sourced
Connected apps and ECAs from a partner that are used by more than two customer production orgs must enable PKCE, refresh token rotation, a 30-day idle refresh token limit, and a refresh token IP allowlist (256 addresses total), then self-attest, which locks the controls. Due date May 11, 2026. Missing it can lead to delisting or suspension.
Secure Your Connected Apps and External Client Apps
sourced · official docs · 2026-10-28
probed
Salesforce publishes an OpenID Connect discovery document at login.salesforce.com. It lists S256 as the only PKCE method and 39 scopes, including offline_access and refresh_token.
login.salesforce.com OIDC discovery
HTTP 200, JSON. authorization_endpoint and token_endpoint on login.salesforce.com.
probed · probe · 2026-10-28
Full accessNo review · Admin-level
full
No review, but security teams push back. Use api plus refresh_token.
probed
Salesforce publishes an OpenID Connect discovery document at login.salesforce.com. It lists S256 as the only PKCE method and 39 scopes, including offline_access and refresh_token.
login.salesforce.com OIDC discovery
HTTP 200, JSON. authorization_endpoint and token_endpoint on login.salesforce.com.
probed · probe · 2026-10-28
inferred
For an agent product whose customers bring their own orgs, you need a Packaged ECA in a 2GP managed package that each customer admin installs. Nothing in that path needs Salesforce approval. Review is only needed for an AgentExchange listing or for Group and Professional Edition customers.
Combines e1, e3, e5, e9, e10, e13. A Local ECA only works in its own org, new connected apps cannot be created, and old connected apps are blocked in orgs where they are not installed (e6), so customer installation is needed either way.
inferred · reasoning · 2026-10-28

Requirements

Steps

Prototype

Sign up for Developer EditionYou10 min
Create a free org at developer.salesforce.com/signup. You land in Setup with a My Domain like yourname-dev-ed.develop.my.salesforce.com.
https://developer.salesforce.com/signup
sourced
API access is on by default in Enterprise, Performance, Unlimited, and Developer Edition orgs. Professional Edition needs a paid add-on. Calls to an org without API access fail with API_DISABLED_FOR_ORG. Each user also needs the API Enabled permission.
Supported Editions and Required Permissions
sourced · official docs · 2026-10-28
Create a Local External Client AppYou20 to 40 min
In Setup, open App Manager and click New External Client App. Keep Distribution State Local, enable OAuth, add your callback URL, select api and refresh_token, offline_access, and select Require PKCE and refresh token rotation. The consumer key and secret are on the app's Settings tab, behind an emailed code.
sourced
Creating connected apps is restricted as of Spring '26. Existing connected apps keep working, Salesforce recommends external client apps instead, and you must contact Salesforce Support if you still need to create a connected app.
Authorization Through External Client Apps or Connected Apps and OAuth 2.0
sourced · official docs · 2026-10-28
sourced
In ECA OAuth settings, the redirect URI must match one of the listed callback URLs (2000 character limit, HTTPS or a custom scheme for flows that pass tokens). You can require PKCE, which blocks web server flows that skip it, and you can turn on a new refresh token on each refresh.
Configure the External Client App OAuth Settings
sourced · official docs · 2026-10-28
sourced
You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days.
Create an External Client App in Your Org
sourced · official docs · 2026-10-28
Build the PKCE web server flowAgent2 to 4 hours
Send users to /services/oauth2/authorize on login.salesforce.com, test.salesforce.com, or the customer's My Domain. Use an S256 code_challenge, and exchange the code with code_verifier and client_secret. Store the instance URL per connection.
sourced
All OAuth endpoints need HTTPS. Supported hosts are login.salesforce.com, a My Domain URL, an Experience Cloud site URL, or a custom URL. For sandboxes, use test.salesforce.com or the sandbox My Domain login URL.
OAuth Endpoints
sourced · official docs · 2026-10-28
probed
Salesforce publishes an OpenID Connect discovery document at login.salesforce.com. It lists S256 as the only PKCE method and 39 scopes, including offline_access and refresh_token.
login.salesforce.com OIDC discovery
HTTP 200, JSON. authorization_endpoint and token_endpoint on login.salesforce.com.
probed · probe · 2026-10-28
probed
The authorization endpoint at login.salesforce.com is live and rejects an unknown client ID with an error in the response body rather than a redirect.
Authorize endpoint probe
HTTP 400, body error=invalid_client_id, error_description=client identifier invalid. No redirect to the callback.
probed · probe · 2026-10-28
probed
The sandbox host test.salesforce.com publishes its own OIDC discovery document with issuer https://test.salesforce.com and S256 PKCE.
test.salesforce.com OIDC discovery
HTTP 200, JSON.
probed · probe · 2026-10-28
inferred
Each customer org has its own My Domain host, so store the instance URL returned for each connection and send API calls there instead of to a fixed host.
Follows from e17 (several valid hosts per org, sandboxes separate). The token response field name instance_url is from our general knowledge, not a page fetched in this run.
inferred · reasoning · 2026-10-28
Handle refresh token rotationAgent1 to 2 hours
Store each new refresh token and serialize refreshes per connection. Refresh at least every few weeks to beat a 30-day idle limit. Treat a failed refresh as a reconnect prompt.
sourced
Connected apps and ECAs from a partner that are used by more than two customer production orgs must enable PKCE, refresh token rotation, a 30-day idle refresh token limit, and a refresh token IP allowlist (256 addresses total), then self-attest, which locks the controls. Due date May 11, 2026. Missing it can lead to delisting or suspension.
Secure Your Connected Apps and External Client Apps
sourced · official docs · 2026-10-28
sourced
In ECA OAuth settings, the redirect URI must match one of the listed callback URLs (2000 character limit, HTTPS or a custom scheme for flows that pass tokens). You can require PKCE, which blocks web server flows that skip it, and you can turn on a new refresh token on each refresh.
Configure the External Client App OAuth Settings
sourced · official docs · 2026-10-28

Limited beta

Enable Dev Hub and namespaceYou30 to 60 min
Turn on Dev Hub in the owning org. This cannot be undone. Register a namespace in a separate Developer Edition org and link it from Namespace Registries.
sourced
To package an ECA you create a managed 2GP with Salesforce CLI from a Salesforce DX project, using a Dev Hub org with a namespace prefix. The Dev Hub owns the package and the namespace cannot be changed. Default policies you set show on the distributed app and the customer's admins can edit them.
Package the External Client App for Canvas
sourced · official docs · 2026-10-28
sourced
A third-party integration guide for multi-tenant SaaS uses a Packaged ECA: enable Dev Hub (irreversible), register a namespace in a separate org and link it, create the ECA with Distribution State Packaged, retrieve its metadata, run sf package version create, and send customers the install URL.
Nango: Salesforce OAuth app setup
sourced · community · 2026-10-28
Create the Packaged appYou30 min
In a long-lived org, create an ECA with Distribution State Packaged and the OAuth settings from s2. Set default policies.
sourced
External client apps are local by default. A Local app can be used only in the context of its own org. A Packaged app can be added to a second-generation (2GP) managed package and distributed. Connected apps, by contrast, were globally available by default.
Trailhead: Use External Client Apps When Connected Apps Won't Do
sourced · official docs · 2026-10-28
sourced
OAuth consumer credentials of an ECA are global settings. They are not packaged but stored in a long-lived org that exists for the life of all package versions. A subscriber org can share the original app's consumer credentials or the app can generate new credentials there; configuring credentials locally breaks the association.
Trailhead: Package and Distribute External Client Apps
sourced · official docs · 2026-10-28
sourced
To package an ECA you create a managed 2GP with Salesforce CLI from a Salesforce DX project, using a Dev Hub org with a namespace prefix. The Dev Hub owns the package and the namespace cannot be changed. Default policies you set show on the distributed app and the customer's admins can edit them.
Package the External Client App for Canvas
sourced · official docs · 2026-10-28
Build a managed 2GP versionAgent2 to 6 hours
Retrieve the ECA metadata (ExternalClientApplication, ExtlClntAppOauthSettings, policy files) without the global OAuth settings. Run sf package create and sf package version create, promote, and copy the install URL.
sourced
To package an ECA you create a managed 2GP with Salesforce CLI from a Salesforce DX project, using a Dev Hub org with a namespace prefix. The Dev Hub owns the package and the namespace cannot be changed. Default policies you set show on the distributed app and the customer's admins can edit them.
Package the External Client App for Canvas
sourced · official docs · 2026-10-28
sourced
A third-party integration guide for multi-tenant SaaS uses a Packaged ECA: enable Dev Hub (irreversible), register a namespace in a separate org and link it, create the ECA with Distribution State Packaged, retrieve its metadata, run sf package version create, and send customers the install URL.
Nango: Salesforce OAuth app setup
sourced · community · 2026-10-28
Send the install linkYou15 min
Send the install URL and the email draft to a design partner admin. Ask them to install in a sandbox first.
sourced
When a managed package has not been authorized by the ISV Partner Program (never reviewed, under review, or failed), customers see a notice during installation and must confirm they understand it is not authorized before installing.
Install Notifications for Unauthorized Managed Packages
Page sits in the first-generation packaging guide. The second-generation guide has the same text (e31).
sourced · official docs · 2026-10-28
sourced
From early September 2025, uninstalled connected apps are blocked for most users. Users who already authorized an app keep access unless it uses the OAuth 2.0 device flow. The Approve Uninstalled Connected Apps permission (Summer '25) and the broader Use Any API Client permission bypass the block.
Get Ready: Changes to Connected App Usage Restrictions Coming This September (Aug 25, 2025)
sourced · official forum or blog · 2026-10-28
sourced
The second-generation packaging guide has the same install notice: customers must confirm they understand an unauthorized managed package is not authorized for distribution before installing. The notice is removed once the ISV Partner Program approves the package.
Install Notifications for Unauthorized Managed Packages (2GP guide)
sourced · official docs · 2026-10-28
Have the admin set policiesYou15 to 30 min per customer
On the app's Policies tab, the admin sets Permitted Users, permission sets, and the refresh token policy, and allowlists the app if needed.
sourced
API Access Control lets an admin block API access except through allowlisted apps. It is turned on by request to Salesforce Customer Support. When on, installed apps are set to Admin approved users are pre-authorized, and only users with the assigned profile or permission set can use them.
Restrict Access to APIs with Connected Apps
Salesforce Help pages did not load for the verifier (JavaScript app), so this claim could not be rechecked. The earlier line that Use Any API Client bypasses API Access Control was removed: Salesforce is deprecating that bypass (e30).
sourced · official docs · 2026-10-28
sourced
You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days.
Create an External Client App in Your Org
sourced · official docs · 2026-10-28
sourced
To package an ECA you create a managed 2GP with Salesforce CLI from a Salesforce DX project, using a Dev Hub org with a namespace prefix. The Dev Hub owns the package and the namespace cannot be changed. Default policies you set show on the distributed app and the customer's admins can edit them.
Package the External Client App for Canvas
sourced · official docs · 2026-10-28

Production

Turn on and attest OAuth controlsYou1 to 2 hours
Enable PKCE, rotation, Limit Idle Refresh Token TTL to 30 Days, and, for web callbacks, Enforce Refresh Token IP Allowlist (256 addresses total). Click Review Controls. The controls then lock, except IP ranges.
sourced
Connected apps and ECAs from a partner that are used by more than two customer production orgs must enable PKCE, refresh token rotation, a 30-day idle refresh token limit, and a refresh token IP allowlist (256 addresses total), then self-attest, which locks the controls. Due date May 11, 2026. Missing it can lead to delisting or suspension.
Secure Your Connected Apps and External Client Apps
sourced · official docs · 2026-10-28
Decide on an AgentExchange listingYou30 min
You do not need a listing to sell.
sourced
API access is not normally available in Group and Professional Edition orgs. After your app passes security review you can request an API token or REST allowlisting so your app can use the standard SOAP and REST APIs there. Bulk API 2.0 stays unavailable.
API Access in Group and Professional Editions
sourced · official docs · 2026-10-28
sourced
Managed packages and API solutions must pass security review to be distributed on AgentExchange (Salesforce's marketplace; older pages and partners call it AppExchange). Salesforce's typical times: 1 to 2 weeks to verify the submission, 3 to 4 weeks for the first test, 2 to 3 weeks to retest a resubmission. Free solutions pay no fee.
How the AgentExchange Security Review Works
sourced · official docs · 2026-10-28
sourced
When a managed package has not been authorized by the ISV Partner Program (never reviewed, under review, or failed), customers see a notice during installation and must confirm they understand it is not authorized before installing.
Install Notifications for Unauthorized Managed Packages
Page sits in the first-generation packaging guide. The second-generation guide has the same text (e31).
sourced · official docs · 2026-10-28
Prepare for security reviewAgent1 to 3 weeks
Enroll in the ISV Partner Program, make the package Lightning Ready, and connect it to the Partner Console. Run Code Analyzer and the source scanner. See the checklist draft.
sourced
Before security review you must enroll in the ISV Partner Program, make the solution Lightning Ready, connect your packaging org to the Partner Console, create a provider profile, run the required scanners (Code Analyzer, Partner Security Portal source scanner), and give reviewers a Developer Edition org with the solution installed plus documentation.
How the AgentExchange Security Review Works
sourced · official docs · 2026-10-28
sourced
A Salesforce security review consultancy says there is no fixed review SLA, first-time submitters often need two or three round trips, and common findings are CRUD/FLS gaps, missing sharing declarations, test orgs whose MFA blocks reviewers, and secrets stored in the wrong place.
Tekunda: How ISVs pass the AppExchange security review
sourced · community · 2026-10-28
Submit the security reviewProvider (wait)4 to 6 weeks per round
Submit in the Partner Console and pay the fee. If not approved, fix every instance of each finding and resubmit (2 to 3 weeks).
sourced
Managed packages and API solutions must pass security review to be distributed on AgentExchange (Salesforce's marketplace; older pages and partners call it AppExchange). Salesforce's typical times: 1 to 2 weeks to verify the submission, 3 to 4 weeks for the first test, 2 to 3 weeks to retest a resubmission. Free solutions pay no fee.
How the AgentExchange Security Review Works
sourced · official docs · 2026-10-28
sourced
For each paid solution, Salesforce asks for a $999 fee for the initial security review submission and for each later attempt, paid by card or bank account in the Partner Console. Most submissions pass on the second attempt.
Trailhead: Guide to Submitting Your Solution for Security Review
sourced · official docs · 2026-10-28

Blockers

You cannot create a new connected app.
Cause: Restricted since Spring '26.
Fix: Create an External Client App.
Help: Salesforce Support.
sourced
Creating connected apps is restricted as of Spring '26. Existing connected apps keep working, Salesforce recommends external client apps instead, and you must contact Salesforce Support if you still need to create a connected app.
Authorization Through External Client Apps or Connected Apps and OAuth 2.0
sourced · official docs · 2026-10-28
sourced
The ISVforce guide says that starting in Spring '26 you can't create new connected apps and should use external client apps (ECAs) instead.
Secure Your Connected Apps and External Client Apps
sourced · official docs · 2026-10-28
Connecting fails in a customer org.
Cause: A Local app only works in its own org.
Fix: Ship a Packaged app in a managed 2GP.
sourced
External client apps are local by default. A Local app can be used only in the context of its own org. A Packaged app can be added to a second-generation (2GP) managed package and distributed. Connected apps, by contrast, were globally available by default.
Trailhead: Use External Client Apps When Connected Apps Won't Do
sourced · official docs · 2026-10-28
sourced
From early September 2025, uninstalled connected apps are blocked for most users. Users who already authorized an app keep access unless it uses the OAuth 2.0 device flow. The Approve Uninstalled Connected Apps permission (Summer '25) and the broader Use Any API Client permission bypass the block.
Get Ready: Changes to Connected App Usage Restrictions Coming This September (Aug 25, 2025)
sourced · official forum or blog · 2026-10-28
The package installs, but authorization is blocked.
Cause: Likely the installed app is not linked to your global OAuth settings.
Fix: Confirm the subscriber app uses your source org's consumer key, then retest in a fresh org.
Help: Trailblazer Community or a Support case from your Dev Hub org.
sourced
OAuth consumer credentials of an ECA are global settings. They are not packaged but stored in a long-lived org that exists for the life of all package versions. A subscriber org can share the original app's consumer credentials or the app can generate new credentials there; configuring credentials locally breaks the association.
Trailhead: Package and Distribute External Client Apps
sourced · official docs · 2026-10-28
inferred
Developers report that a packaged ECA can install fine in a customer org and still fail at authorization when the global OAuth settings association is wrong.
Seen only in search result snippets of a Trailblazer Community thread (OAUTH_AUTHORIZATION_BLOCKED, 'Cross-org OAuth flows are not supported'), which we did not open. Consistent with the association rules in e4.
inferred · reasoning · 2026-10-28
API calls fail with API_DISABLED_FOR_ORG.
Cause: The edition has no API access.
Fix: The customer buys the API add-on, or you pass security review.
sourced
API access is on by default in Enterprise, Performance, Unlimited, and Developer Edition orgs. Professional Edition needs a paid add-on. Calls to an org without API access fail with API_DISABLED_FOR_ORG. Each user also needs the API Enabled permission.
Supported Editions and Required Permissions
sourced · official docs · 2026-10-28
sourced
API access is not normally available in Group and Professional Edition orgs. After your app passes security review you can request an API token or REST allowlisting so your app can use the standard SOAP and REST APIs there. Bulk API 2.0 stays unavailable.
API Access in Group and Professional Editions
sourced · official docs · 2026-10-28
The admin can connect but other users cannot.
Cause: The app is pre-authorized only or API Access Control is on, and those users lack a permission set.
Fix: Ask the admin to assign your app's permission set.
sourced
API Access Control lets an admin block API access except through allowlisted apps. It is turned on by request to Salesforce Customer Support. When on, installed apps are set to Admin approved users are pre-authorized, and only users with the assigned profile or permission set can use them.
Restrict Access to APIs with Connected Apps
Salesforce Help pages did not load for the verifier (JavaScript app), so this claim could not be rechecked. The earlier line that Use Any API Client bypasses API Access Control was removed: Salesforce is deprecating that bypass (e30).
sourced · official docs · 2026-10-28
sourced
You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days.
Create an External Client App in Your Org
sourced · official docs · 2026-10-28
invalid_client_id at the authorize step.
Cause: Wrong host (production vs sandbox), or the wrong consumer key.
Fix: Use the sandbox host for sandboxes and the Packaged app's key.
sourced
All OAuth endpoints need HTTPS. Supported hosts are login.salesforce.com, a My Domain URL, an Experience Cloud site URL, or a custom URL. For sandboxes, use test.salesforce.com or the sandbox My Domain login URL.
OAuth Endpoints
sourced · official docs · 2026-10-28
probed
The authorization endpoint at login.salesforce.com is live and rejects an unknown client ID with an error in the response body rather than a redirect.
Authorize endpoint probe
HTTP 400, body error=invalid_client_id, error_description=client identifier invalid. No redirect to the callback.
probed · probe · 2026-10-28
probed
The sandbox host test.salesforce.com publishes its own OIDC discovery document with issuer https://test.salesforce.com and S256 PKCE.
test.salesforce.com OIDC discovery
HTTP 200, JSON.
probed · probe · 2026-10-28
Refresh fails and the user must reconnect.
Cause: Admin policy expiry, a reused rotated token, or 30 days idle.
Fix: Save every new refresh token and refresh on a schedule.
sourced
Connected apps and ECAs from a partner that are used by more than two customer production orgs must enable PKCE, refresh token rotation, a 30-day idle refresh token limit, and a refresh token IP allowlist (256 addresses total), then self-attest, which locks the controls. Due date May 11, 2026. Missing it can lead to delisting or suspension.
Secure Your Connected Apps and External Client Apps
sourced · official docs · 2026-10-28
sourced
You create an ECA in Setup, with scopes such as api, web, and refresh_token/offline_access and a callback URL (an http://localhost URL is used for Salesforce CLI). On the Policies tab, admins set Permitted Users (for example Admin approved users are pre-authorized, with chosen profiles and permission sets) and a refresh token policy such as expire after 90 days.
Create an External Client App in Your Org
sourced · official docs · 2026-10-28
Admins worry about the not-authorized notice.
Cause: No security review yet.
Fix: Explain it in your install email.
sourced
When a managed package has not been authorized by the ISV Partner Program (never reviewed, under review, or failed), customers see a notice during installation and must confirm they understand it is not authorized before installing.
Install Notifications for Unauthorized Managed Packages
Page sits in the first-generation packaging guide. The second-generation guide has the same text (e31).
sourced · official docs · 2026-10-28
sourced
The second-generation packaging guide has the same install notice: customers must confirm they understand an unauthorized managed package is not authorized for distribution before installing. The notice is removed once the ISV Partner Program approves the package.
Install Notifications for Unauthorized Managed Packages (2GP guide)
sourced · official docs · 2026-10-28
Security review comes back Not Approved.
Cause: Common findings: CRUD/FLS gaps, missing sharing declarations, MFA blocking reviewers, misplaced secrets.
Fix: Fix every instance, rescan, and resubmit.
Help: Partner Security Portal office hours.
sourced
Managed packages and API solutions must pass security review to be distributed on AgentExchange (Salesforce's marketplace; older pages and partners call it AppExchange). Salesforce's typical times: 1 to 2 weeks to verify the submission, 3 to 4 weeks for the first test, 2 to 3 weeks to retest a resubmission. Free solutions pay no fee.
How the AgentExchange Security Review Works
sourced · official docs · 2026-10-28
sourced
A Salesforce security review consultancy says there is no fixed review SLA, first-time submitters often need two or three round trips, and common findings are CRUD/FLS gaps, missing sharing declarations, test orgs whose MFA blocks reviewers, and secrets stored in the wrong place.
Tekunda: How ISVs pass the AppExchange security review
sourced · community · 2026-10-28
Older connections for one user fail with token errors.
Cause: Salesforce keeps five refresh tokens per user per app, so a sixth can revoke the oldest.
Fix: Reuse one connection per user, including in tests.
sourced
Composio's Salesforce toolkit page lists Composio-managed OAuth as available. Its FAQ says users may see OAUTH_APPROVAL_ERROR_GENERIC or 'app must be installed into org', and the fix is for a Salesforce org admin to approve or install the app. It also says Salesforce keeps only five active refresh tokens per user per app, so a sixth connection can revoke the oldest.
Composio: Salesforce toolkit
FAQ answers are in collapsed sections; read from the page HTML.
sourced · composio docs · 2026-10-28

Agent and you

Agent did

Read about 25 official Salesforce, Trailhead, and Composio pages.
Probed OIDC discovery on login and test hosts: both live, S256 PKCE only.
Probed authorize with a bad client ID: HTTP 400 invalid_client_id.
Drafted an admin email and a review checklist.

Agent can do

Write the PKCE flow and token rotation.
Write the Salesforce DX project files.
Run package commands after you log the CLI in.
Run Code Analyzer and summarize findings.
Draft install and reviewer docs.

You must do

Sign in to Salesforce orgs, including MFA.
Enable Dev Hub and register the namespace.
Work with each customer admin.
Enroll as an ISV partner and pay the fee if you list.
Attest the OAuth controls.

Drafts

Email to a customer's Salesforce admin draft · other

DRAFT, edit before use.

Subject: Installing [App name] in your Salesforce org

Hi [Admin name],

[Customer] wants to connect Salesforce to [App name], an AI assistant that [one line]. Salesforce blocks apps not installed in your org, so please install our package. It takes about 15 minutes.

1. Install in a sandbox: [sandbox install URL]. Then production: [production install URL]. Choose Install for Admins Only.
2. You may see a notice that the package is not authorized for distribution. It has not passed AgentExchange security review. [Remove if reviewed.]
3. In Setup, open External Client App Manager, find [App name], and open Policies.
4. Set Permitted Users to Admin approved users are pre-authorized and add a permission set for [App name] users. All users may self-authorize also works.
5. Set the refresh token policy to at least [30/90] days or until revoked, so users do not reconnect often.
6. If you use API Access Control, allowlist [App name].
7. Give those users API Enabled.

We request only api and refresh_token, act as the connecting user, and see only what their permissions allow. You can revoke access anytime.

Questions: [contact]. Security docs: [link].

Thanks,
[Your name]

AgentExchange security review checklist draft · other

DRAFT, edit before use. Check against the current ISVforce guide.

Program
- [ ] ISV Partner Program enrolled (confirmed by a partner rep)
- [ ] Packaging org in the Partner Console
- [ ] Provider profile created
- [ ] Fee: $999 per attempt if paid, none if free

Package
- [ ] Released managed 2GP, major or minor version (not a patch)
- [ ] Lightning Ready
- [ ] External Client App Packaged; secret not in source control

OAuth controls
- [ ] PKCE required
- [ ] Refresh token rotation on
- [ ] 30-day idle refresh token limit
- [ ] Refresh token IP allowlist (256 addresses max)
- [ ] Controls attested

Code and scans
- [ ] Code Analyzer findings fixed
- [ ] Source code scanner run on the release
- [ ] CRUD/FLS checks on every read and write
- [ ] Sharing keywords on every DML class
- [ ] No secrets in custom metadata, custom settings, or debug logs
- [ ] External web app scanned
- [ ] False positives documented

Reviewer materials
- [ ] Developer Edition org with the release and sample data
- [ ] Reviewer login not blocked by MFA
- [ ] Data flow doc: what leaves Salesforce, where, how long
- [ ] External app test account

After
- [ ] Plan for 1 to 2 weeks verification plus 3 to 4 weeks testing
- [ ] If not approved: fix every instance, rescan, resubmit

Package and listing description draft · app description

DRAFT, edit before use.

[App name] connects Salesforce to an AI assistant that [reads accounts, opportunities, and activity, and drafts updates for review]. Users connect with their own login. The assistant sees only what that user's permissions allow.

This package installs one External Client App, [App name]. No Apex, objects, or fields. [Adjust if needed.]

Access: api and refresh_token, so the assistant works while the user is offline. Admins control access on the Policies tab.

Data handling: [what you store, where, retention, deletion].

Question to Salesforce partner support draft · support email

DRAFT, edit before use.

Hello,

We build [App name], an AI assistant. We plan to distribute a Packaged External Client App in a managed 2GP by install link, without an AgentExchange listing.

1. Can we distribute it to paying customers before security review?
2. Should every subscriber org share our consumer key?
3. Do the May 11, 2026 OAuth controls apply before we join the ISV Partner Program?
4. What is the current review fee for a paid API solution?

Dev Hub org ID: [org ID]. Namespace: [namespace].

Thanks,
[Your name]

Open questions

Can you sell an unlisted package without review?
Unreviewed packages work (e13, e33), but Salesforce says unapproved solutions cannot be distributed (e32).
To resolve: Ask your partner account manager.
Do subscriber orgs reuse your consumer key?
Trailhead says both are possible, and per-org keys mean one client ID per customer, including in Composio.
To resolve: Install in two scratch orgs and compare keys.
Do the May 2026 controls apply before you are a partner?
The page does not define partner for an unlisted app.
To resolve: Ask partner support, or turn them on anyway.
What is the current review fee?
Trailhead says $999 per paid attempt, unopened search results show an older $2,550, and ISVforce states none.
To resolve: Check the Partner Console review wizard.
How long does security review take?
We found no dated developer reports.
To resolve: Ask in Trailblazer Community ISV groups.

Sources

Authorization Through External Client Apps or Connected Apps and OAuth 2.0 official docs · 2026-10-28
Secure Your Connected Apps and External Client Apps official docs · 2026-10-28
Trailhead: Use External Client Apps When Connected Apps Won't Do official docs · 2026-10-28
Trailhead: Package and Distribute External Client Apps official docs · 2026-10-28
Package the External Client App for Canvas official docs · 2026-10-28
Get Ready: Changes to Connected App Usage Restrictions Coming This September (Aug 25, 2025) official forum or blog · 2026-10-28
Restrict Access to APIs with Connected Apps official docs · 2026-10-28
Supported Editions and Required Permissions official docs · 2026-10-28
API Access in Group and Professional Editions official docs · 2026-10-28
How the AgentExchange Security Review Works official docs · 2026-10-28
Trailhead: Guide to Submitting Your Solution for Security Review official docs · 2026-10-28
Install Notifications for Unauthorized Managed Packages official docs · 2026-10-28
Configure the External Client App OAuth Settings official docs · 2026-10-28
Create an External Client App in Your Org official docs · 2026-10-28
OAuth Endpoints official docs · 2026-10-28
login.salesforce.com OIDC discovery probe · 2026-10-28
Authorize endpoint probe probe · 2026-10-28
test.salesforce.com OIDC discovery probe · 2026-10-28
Composio managed auth toolkits composio docs · 2026-10-28
White-labeling authentication composio docs · 2026-10-28
Custom app vs managed app composio docs · 2026-10-28
Nango: Salesforce OAuth app setup community · 2026-10-28
Tekunda: How ISVs pass the AppExchange security review community · 2026-10-28
Composio: Salesforce toolkit composio docs · 2026-10-28
CData Community: API Access Control change (Oct 2025) community · 2026-10-28
Install Notifications for Unauthorized Managed Packages (2GP guide) official docs · 2026-10-28
Salesforce Stack Exchange: Managed package and security review community · 2026-10-28
Torii: How to audit connected apps in Salesforce community · 2026-10-28

Verification changes

Verdict summary now names Group and Professional Edition orgs without the API add-on, and the 'not authorized for distribution' install notice.
Professional Edition with the API add-on has API access without review (e8). Salesforce's own wording calls unreviewed packages not authorized for distribution (e31, e32). Added a community source that unreviewed packages install and work (e33) and a second source for the connected app changes (e35). 2026-10-28
Removed the claim that users with Use Any API Client bypass API Access Control, and noted the bypass is going away.
A community post reports Salesforce deprecated Use Any API Client within API Access Control in October 2025. The cited help page could not be loaded to recheck. 2026-10-28
Composio note now says a customer admin may need to approve or install Composio's app. Removed the matching open question.
Composio's Salesforce toolkit FAQ answers it: the 'app must be installed into org' error is fixed by an org admin approving or installing the app. 2026-10-28
Confirmed the install notice applies to 2GP packages and linked the 2GP guide.
The same page exists in the second-generation packaging guide. 2026-10-28
Production notes now give Salesforce's 'most pass on the second attempt' and label 2 to 4 months as our estimate.
The 2 to 4 month figure is not stated by any source. It is arithmetic from the stated stage times plus one or two retests and fix time. 2026-10-28
Narrowed the IP allowlist control to apps with a web callback URL, and noted IP ranges stay editable after attestation.
The ISVforce page says to enable the allowlist only if the callback is not localhost, a Salesforce org, or a custom URL scheme, and that IP ranges can still be updated. 2026-10-28
Step s2 now starts from App Manager and says a verification code is emailed before you can copy the key and secret.
The Salesforce CLI guide creates the app from App Manager and shows the email verification step on the Settings tab. 2026-10-28
Rewrote two open questions: unreviewed distribution now cites Salesforce's 'not authorized for distribution' wording; the fee question says the older figures were not opened.
Keep uncertainty honest about what was read. 2026-10-28
e10 no longer says AgentExchange was 'formerly called AppExchange'.
The cited page uses only AgentExchange. Other pages use AppExchange, but none we read states the rename. 2026-10-28
Added a blocker: only five active refresh tokens per user per app.
Found on Composio's Salesforce toolkit FAQ while checking managed app status. 2026-10-28
Composio note: replaced "When you switch to your own auth config, only new connections use it; existing users stay on the old one until they reconnect." with the switching rule as Composio states it, including importing credentials.
A reviewer cross-checked Composio's docs: existing users stay on the old connection until they re-authenticate or you import their credentials, so "must reconnect" overstated it. 2026-10-28