Salesforce API Authorization and Client-App Onboarding
Overview
Choose the app and OAuth model, establish least privilege, and prove read-only access without defaulting to legacy username-password automation.
Prerequisites
- Target org, edition, domain, environment, integration purpose, and data classes
- Identity, security, Salesforce administration, application, and support owners
- Current org policy and first-party OAuth documentation
Tool Discipline
Use Read, Glob, and Grep to inspect approved repository and evidence files, WebFetch to re-check current first-party Salesforce documentation, and Write or Edit only for secretless plans, fixtures, configuration, and redacted receipts.
Current Contract
Salesforce REST API supports OAuth through External Client Apps or Connected Apps. Creating Connected Apps is restricted as of Spring '26; existing Connected Apps can continue, while Salesforce recommends External Client Apps for new integrations.
Authentication
Select an OAuth flow from current Salesforce documentation for the workload and client type. Never copy browser sessions, use a human password in automation, log tokens, or assume that one flow, scope set, or login host fits every org.
Instructions
- Record the org, My Domain, edition, environment, workload, required resources, and accountable owners.
- Determine whether the org requires an External Client App or has an approved existing Connected App.
- Map the selected OAuth flow, scopes, policies, principal, certificate or secret custody, expiry, rotation, and revocation.
- Inspect the repository for password flows, unpinned login hosts, broad scopes, plaintext keys, and mixed-org aliases.
- Present app creation, policy, permission-set assignment, pre-authorization, and credential issuance for explicit approval.
- After provisioning, discover supported API versions and run the smallest documented read-only identity or resource check.
- Store only secret references and a redacted receipt; test revocation and recovery in a non-production org.
Approval Boundaries
Do not create or alter a client app, grant scopes, assign permissions, issue credentials, or test production writes without the named org and security owners.
Output
Return the app-type decision, OAuth contract, access matrix, secret references, read-only verification, rotation and revocation owners, and unresolved policy questions.
Error Handling
| Condition | Response |
|---|---|
| New Connected App creation is unavailable | Use the org-approved External Client App path or obtain Salesforce Support guidance; do not bypass the restriction. |
| Authorization succeeds but a resource is denied | Compare scopes, permission sets, CRUD, field access, sharing, edition, and API entitlement independently. |
| Current OAuth contract is unknown | Stop before provisioning and obtain current org-specific documentation. |
Example
A redacted completion receipt might look like this:
org=sandbox; app=external-client-app; flow=org-approved; scopes=least-privilege; probe=read-only-pass; secrets=referenced
Resources
Next Steps
Run the workflow first in the lowest-risk authorized org and preserve its redacted receipt. Schedule a review against the next Salesforce seasonal release and the customer change calendar.