When you encounter a Remote Access Application reference in legacy documentation or code, the right action is to translate it to the modern Connected App equivalent. The walkthrough below covers the typical sequence for updating documentation, code, and configuration to current terminology and capabilities. The goal is not just terminology consistency; it is also an opportunity to evaluate whether the legacy integration still uses the right OAuth flow and security posture for current threat models.
- Locate the equivalent Connected App in Setup
From Setup, navigate to App Manager and find the Connected App that corresponds to the legacy Remote Access Application. The matching record has the same client ID; the name may have changed during the rename or may be the same. Review the configuration: OAuth scopes, callback URLs, profile and permission set authorization, IP restrictions, session policies. Confirm the Connected App is still active and serving the integration as expected.
- Update internal documentation
Search the org's runbook, wiki, and integration architecture documents for references to Remote Access Application. Replace each occurrence with Connected App. Add a brief note about the historical rename for any document that is heavily referenced by new staff. Update any architectural diagrams that show the integration topology. The goal is consistent vocabulary across all internal communication.
- Update code, URLs, and external references
Search the Apex codebase, external integration repos, and partner documentation for references to the legacy term. Update class names, variable names, and comment text to use connected_app or similar modern conventions. Update any hardcoded URL paths that include remoteaccess to use the current connectedapp equivalent. Test the updated code in sandbox to confirm no behavior change before promoting to production.
- Modernize the OAuth flow if appropriate
Evaluate whether the integration is using the most appropriate OAuth flow for its scenario. Legacy Remote Access Application integrations were often built on username-password flow, which is now discouraged. Modern alternatives include OAuth 2.0 JWT bearer flow for server-to-server integrations, authorization code with PKCE for browser-based apps, and OAuth 2.0 client credentials for trusted machine-to-machine scenarios. Update the Connected App configuration to support the new flow, update the integration code, and test thoroughly before retiring the legacy flow.
- Some old documentation refers to Setup paths that no longer exist (Setup > Develop > Remote Access). The modern path is Setup > Apps > App Manager > Connected Apps.
- Username-password OAuth flow is still supported for backward compatibility but is discouraged. Modern integrations should use JWT bearer, authorization code with PKCE, or client credentials.
- Client secrets from the original Remote Access Application registration are still valid in the migrated Connected App. Rotating the secret is good security hygiene but is not forced by the rename.
- Some legacy customer integrations still hit the old Salesforce documentation URLs that redirect to the new Connected App pages. The redirects work but the URL itself may look outdated.
- Updating documentation without updating the underlying mental model is a half-measure. Train the team on what a Connected App is and why the rename happened.