Connected Apps are how external systems integrate with Salesforce — OAuth flows, API access, SAML/OIDC SSO, mobile apps. Every integration that hits the Salesforce API needs one. Setup is short; the consumer key + secret it generates are what your external system uses.
- Open Setup → App Manager
Setup → Quick Find: App Manager → App Manager.
- Click New Connected App
Top-right. Distinguishes itself from Lightning Apps.
- Fill Basic Information
Connected App Name, API Name, Contact Email. App Logo URL and Info URL are optional but show up to users at consent time.
- Tick Enable OAuth Settings
Almost always required. Reveals OAuth-specific fields.
- Set Callback URL and Selected OAuth Scopes
Callback URL is where Salesforce redirects after consent — must match what your external app sends. Scopes are what the integration can do (api, refresh_token, openid, full).
- Save
Salesforce generates Consumer Key and Consumer Secret. Save now and these are what your external system uses to authenticate.
- Configure post-save: Manage → OAuth Policies
Set Permitted Users (All users may self-authorize / Admin approved users), IP Relaxation, Refresh Token Policy.
Where Salesforce redirects after OAuth consent. Must match exactly. https://localhost is allowed for dev.
api (most common), refresh_token (for long-lived sessions), openid (for OIDC SSO), full (rarely needed).
All users may self-authorize / Admin approved users are pre-authorized. Pre-authorized is more secure.
Whether the connected app respects the org's Login IP Ranges or relaxes them.
Refresh token valid until revoked / expires after N days / immediately expires.
- Consumer Key and Consumer Secret only show fully on the first save. Once you navigate away, the Secret is hidden. Save them in your secrets manager immediately.
- Callback URL must match exactly — including trailing slash. Mismatch = OAuth fails with a generic error.
- After Save, it can take 2-10 minutes for the Connected App to propagate to Salesforce's auth servers. Don't panic if your first OAuth attempt 401s right after creating the app — wait and retry.