OAuth app readiness guide · CRM

Getting your Salesforce app ready for real users

Checked against official docsChecked 2026-10-27salesforce.com

Verdict. No vendor review, but the rules changed twice in a year. New apps are External Client Apps, and since September 2025 each customer's admin may need to approve your app before their users can connect.

At a glance

The answer in one screen

Ease of creation

Moderate

External Client App in a Developer Edition org. Not tested by us.

Ease of approval

Admin-gated

No Salesforce review, but customer admins decide.

Your hands-on time

1 to 3 hours

App, policies, and a customer-admin enablement note.

Waiting on the provider

Per customer

Depends on each customer's admin.

Do you need your own app yet?

Often your own app.

Composio lists private Salesforce subdomains as a reason to bring your own app.

Watch out: decisions you can't undo

Connected Apps can no longer be created. Build on External Client Apps.
Your home org matters. Keep a dedicated Developer Edition org alive for the app.

Agent an agent can do it You needs you Waiting on the provider

Prerequisites

What to have ready

To create and connect

Developer Edition org
Callback URL

For approval (can take days)

Customer-admin instructions for approving or installing your app

App types

Which one is right for an agent product?

Connected App (legacy)

Existing apps only.

Who can install: Existing behaviour
Review: None
Use it for: Keep running; no new ones

Recommended for agents

External Client App, local

Created in your org.

Who can install: Your org
Review: None
Use it for: Building and testing

External Client App, packaged

Inside a 2GP managed package.

Who can install: Orgs that install your package
Review: AppExchange if listed
Use it for: Multi-org distribution

Cross-org behaviour is unclearA Trailblazer thread shows OAUTH_AUTHORIZATION_BLOCKED after installing a packaged ECA, with no confirmed answer. Test with a real customer org before promising dates. Not verified

Creation steps

Who does what, and how long it takes

YouGet a Developer Edition org
15 min
The app's home org.
AgentCreate an External Client App
15 min
Setup, App Manager, New External Client App; enable OAuth.
AgentSet callback, scopes and policies
20 min
Refresh token validity and session timeout suit long-running agents.
YouReveal consumer key and secret
5 min
Salesforce emails a verification code first.
AgentWrite the customer-admin note
20 min
How to install or approve your app, and grant the approval permission.

Scopes

What each permission costs you

Salesforce scopes are broad API grants set on the app.

Agent use case	Scopes	What it costs you
Call REST APIs	`api`	Standard
Stay connected	`refresh_tokenoffline_access`	Needed for unattended agents

Minimal set: "CRM assistant" agentapirefresh_token

Add web only if you need it.

Changing scopes later

Edit the app's OAuth settings; users reauthorize.

Approval and distribution

Review, cost and renewal

When you need it: No Salesforce review for OAuth. Customer admins may need to approve your app. Cost: None. Renewal: None.

Per customer

Varies

Admin installs the app or grants "Approve Uninstalled Connected Apps".

What you submit

Nothing to Salesforce for OAuth

Common rejection reasons

Not applicable

Before approval: what works and what's capped

Build and test

ECA in your org.

Limit: No new Connected Apps.

First customers

Users authorize via login.salesforce.com or My Domain.

Limit: Users need admin approval for uninstalled apps since Sept 2025.

Scale

Packaged ECA or AppExchange.

Limit: Cross-org packaging behaviour not well documented.

Data use and compliance

Rules that shape agent design

Customer admin control. Admins decide which apps their users may authorize.

Common blockers

Symptom, cause, fix

Symptom	Cause	Fix
OAUTH_APPROVAL_ERROR or authorization blocked	Uninstalled app and user lacks approval permission	Customer admin installs or approves your app
Cannot create a Connected App	Spring '26 restriction	Use an External Client App
Sandbox users cannot log in	Wrong login host	Use test.salesforce.com for sandboxes

Sources

Where every claim comes from

Claim	Source
Connected App creation restricted from Spring '26	Official docs
Uninstalled app restriction from Sept 2025	Secondary source
Packaged ECA cross-org behaviour	Not verified

All sources

Salesforce: Connected Apps restriction notice developer.salesforce.com
Salesforce: Create an External Client App developer.salesforce.com
Soliant: Connected app security changes www.soliantconsulting.com