Salesforce is replacing Connected Apps with External Client Apps (ECAs). You can still link your org with external tools like WordPress or Sawfish. ECAs offer the same features but provide a more secure, modular architecture.
As of Spring ’26, Salesforce disables new Connected App creation by default. The platform now steers all users toward the ECA framework. This change ensures your data stays protected using modern standards.
Why Choose ECAs?
ECAs separate developer settings from admin policies. This division prevents security gaps during deployment. These apps also work perfectly with 2nd Generation Managed Packaging (2GP).
This design helps developers distribute apps across environments without manual resets. Furthermore, ECAs use a “closed” security posture. This gives you precise control over exactly what an external application can access.
The Future of Outside Apps
Will Salesforce block outside integrations? The short answer is no. Salesforce relies on an “API-first” philosophy. It is nearly impossible to imagine the platform without external connectivity.
Plugins like Sawfish use OAuth 2.0. This protocol remains the backbone of modern IT integrations. Salesforce is simply upgrading the container that manages these credentials. Your integrations are safe.
Managing Existing Connections
Your existing Connected Apps will still function. Salesforce provides a long transition period for current users. You do not need to panic or migrate everything overnight.
However, the “writing is on the wall.” You should build all new integrations as ECAs to stay future-proof. This proactive step prevents technical debt in the coming years.
Building Your First External Client App (ECA)
You can manage this process via the Metadata API or the Setup menu. Follow these steps to start:
- Enable Settings: Navigate to Setup and enable External Client Apps.
- Create the App: Select the External Client App section instead of Connected Apps.
- Define OAuth: Set your Scopes and Callback URL as you did before.
- Get Consumer Key & Consumer Secret: Access these from the OAuth settings menu.
- Permissions: You may need to assign specific permissions such as Creation of External Client Apps.