Every claim is tagged: tested, sourced, reported, inferred or unknown. See how

← All guides
Researched guide

Salesforce

Create an External Client App (the preferred framework). Creating Connected Apps is disabled by default and may need Salesforce Support to enable. No marketplace review is needed for your own org.

Tier 2 · Light checks30-60 min hands-onResearched 2026-10-20
DifficultyTier 2 · Light checks

Sourced Self-serve in a dev org, but Connected Apps are disabled by default and need enablement; many settings (scopes, secret/PKCE, policies) can silently break the flow. [e1]

Your time (hands-on)30-60 min

Inferred Our estimate from the number of settings. Composio's guide shows only a 4-minute reading time.

Approval waitAbout 10 minutes

Sourced Creating the app takes about 10 minutes to provision, per Composio's guide. Only if you distribute a package, Salesforce's security review adds stated stages: 1-2 weeks verification plus 3-4 weeks testing (retests 2-3 weeks). Salesforce says these are estimates. [e2]

Composio managed authAvailable

Sourced Composio's Salesforce toolkit page lists OAuth2 and S2S_OAUTH2 and says 'Composio-managed OAuth available.' So a developer can connect users without registering their own provider app first; register your own only for your own branding, scopes or rate limits.

Open Composio's toolkit page

Who does what

An agent can

  • Explain settings and build the Composio config from credentials you provide safely.

You must

  • Operate Setup in your org and contact Salesforce Support if needed.

Steps

  1. Get a Salesforce orgYouSourced

    Use an existing org or sign up for a developer account. [e2]

    Why you: Account creation and email verification.

  2. Create an External Client AppYouSourced

    Setup > App Manager > New External Client App; name, contact email, Distribution State Local. [e2]

    Why you: Needs your signed-in Salesforce admin session.

  3. Enable OAuth with Composio's callback URLYouSourced

    Enable OAuth, set the callback URL from your Composio auth config, add scopes (api, refresh_token/offline_access). [e2]

    Why you: Needs your Salesforce session.

  4. Copy consumer key and secretYouSourced

    Found in the app's OAuth settings consumer details; you may be asked for an emailed verification code. [e1][e2]

    Why you: Verification code goes to you; secret goes to your secret store.

  5. Create the Composio auth configYou or agentSourced

    Enter key, secret, redirect URI and your My Domain subdomain. [e2]

Requirements

  • Sourced A Salesforce org (a free developer account gives a dev org) where you can open Setup. [e2]
  • Sourced For a Connected App: Salesforce says creating them is now disabled by default; contact Salesforce Customer Support to enable it (one-time per org), then turn on 'Allow creation of connected apps'. [e1]
  • Sourced An external client app is Salesforce's packageable framework for letting a third-party application integrate through APIs and OAuth. [e6]
  • Sourced OAuth secrets are kept out of packages: external client apps split settings into a global file (consumer credentials) and a local file. [e7]

Scopes and access

  • Sourced Typical scopes: api, refresh_token/offline_access (and optionally openid). Salesforce's own CLI example sets refresh-token expiry to 90 days or less as a security best practice. [e1][e2]

Review process

  • Sourced Salesforce's security review applies to managed packages and Salesforce Platform API solutions you distribute (Salesforce's page now calls it the AgentExchange security review). [e5]
  • Sourced Stated stage durations: verification of submission 1-2 weeks, first-time Product Security testing 3-4 weeks, retest of a resubmission 2-3 weeks. Salesforce says 'The time frames are estimates.' [e3]
  • Inferred Our sum of the first-submission stages is roughly 4-6 weeks end to end; Salesforce does not state a total. [e3]
  • Sourced The page gives no fee amount; if you distribute for free you do not pay the review fee. [e4]
  • Inferred Connecting Composio to your own org through an external client app is not described as needing the security review; the review is about distributing a package. [e5]

Gotchas

  • Sourced External Client Apps are called the preferred integration framework; Connected Apps are being deprecated. [e1]
  • Sourced Composio's guide says keep 'Require Secret' options checked and uncheck 'Require PKCE' unless you want PKCE. [e2]
  • Sourced The Composio auth config also needs your My Domain subdomain (without .salesforce.com). [e2]

If you get stuck

Sourced You cannot find the option to create a Connected App

Likely cause: Connected App creation is disabled by default in newer orgs.

Fix: Use an External Client App instead, or ask Salesforce Support to enable Connected App creation.

Escalate when: You specifically need a Connected App. [e1]

Sourced App just created but login fails

Likely cause: A new Connected App can take about 10 minutes to provision.

Fix: Wait and retry.

Escalate when: Still failing after about an hour. [e2]

Next actions

  • Prefer the External Client App path.
  • Set the My Domain subdomain correctly in Composio.

What was tested

Nothing here has been tested by hand yet.

What we are unsure about

  • Salesforce's help article on the connected-app to external-client-app change did not load; we could not quote whether new connected apps can still be created.
  • Org edition differences (Developer vs production orgs) were not researched.
  • The 1-2 / 3-4 / 2-3 week figures were read through a page summary; verify-quotes should confirm the wording.
  • No hands-on test logged yet.

Sources

  1. [e1] Salesforce DX Dev Guide - Create a Connected App in Your Org
    Creating connected apps is now disabled by default.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  2. [e2] Composio - Salesforce OAuth2 credentials
    Salesforce may take ~10 minutes to fully provision it.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  3. [e3] Salesforce Developers - How the security review works
    The time frames are estimates.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  4. [e4] Salesforce Developers - How the security review works
    If you plan to distribute your solution for free, you don't pay the fee.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  5. [e5] Salesforce Developers - How the security review works
    To distribute managed packages, Salesforce Platform API solutions, or Marketing Cloud Engagement API solutions
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  6. [e6] Salesforce Help - External client apps
    packageable frameworks to enable a third-party application to integrate with Salesforce using APIs and security protocols
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  7. [e7] Salesforce Help - External client apps
    OAuth settings contain sensitive information like OAuth secrets that must not be packaged or distributed.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  8. [e8] Composio docs - Salesforce toolkit, Authentication Details
    Composio-managed OAuth available
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page

Ask this guide

Questions about the ten library providers are answered from the guides, with the passage each answer rests on. For any other app it researches the web live and says so.

About the builder

Built by Moulshree Bhutra

Founding APM at Vudio.ai, applying for APM, Toolkits at Composio (Bangalore). This prototype is my answer to the take-home: a way for a developer to see the cost of an OAuth app before starting, and to trust what they read.

How I approached the problem

  • Started from what already exists. Composio publishes 46 setup guides. I read ten in full: they cover the clicking, but not setup time, difficulty or the approval wait, which is where teams lose weeks.
  • Designed for one decision. A developer asks "should I start this today?" So effort, wait, and what only you can do come first, and the steps come after.
  • Made trust visible. Every claim is tagged tested, sourced, reported, inferred or unknown, and quotes link to the page they came from. Where no provider states a number, the guide says so instead of guessing.
  • Kept the agent honest in code. The live agent cannot mark anything tested, and a quote it cannot find in a page it actually read is removed. The method page lists what was and was not checked.

Why I am a good fit

  • I have owned a product through integrations and AI. At Vudio.ai I worked across three roles as it grew from a video-commerce tool into an AI marketing platform with 10+ modules, including Shopify-connected widgets and the product side of its Campaign agent.
  • Results I can point to. I contributed to about 7x ARR growth ($30K to $0.2M) over two years through 0 to 1 launches. I redesigned Shoppable Widgets and built self-serve onboarding: activation rose about 74% and turnaround fell from 13 days to 4. I led AI Studio from 0 to 1 (ARPU up 5% among fashion brands) and built an analytics dashboard that lifted free-to-paid conversion about 10%.
  • I build to understand. I have a computer science degree and I prototype my own ideas, so I can talk to engineers about trade-offs. Top 3 of 200+ in NextLeap's Product Management Fellowship.
  • I write down what I do not know. This project lists its own gaps, including that the hands-on registrations are still being run.

Find me

Prototype built for the Composio APM, Toolkits take-home. It never asks for credentials or secrets.