You cannot create a new connected app in Salesforce anymore. The Spring '26 release blocked it by default in every org, through both the Setup UI and the Metadata API. What you create instead is an External Connected App, and Appnigma provisions one for you in about two minutes with your client key, secret key and a managed package link.
Can you still create a connected app in Salesforce?
Not by default, and not by choice. Salesforce retired the creation path in two stages. Winter '26 switched off UI creation by default on new orgs while leaving an admin opt-in. Spring '26 closed that opt-in.
As of Spring '26, creating a new connected app is blocked in both the Setup UI and the Metadata API, and administrators can no longer re-enable it themselves. There is no permission you can grant yourself and no setting buried in Setup. Re-enabling it requires opening a case with Salesforce Support.
Existing connected apps still work. Nothing was switched off, including ones delivered inside installed packages. Only new creation is closed.
So if you came here because the New Connected App button is greyed out or missing, your org is fine. You are looking at a path Salesforce closed on purpose.
What do you create instead of a connected app?
The replacement is the External Client App, which Salesforce shortened to ECA. It does the same job: it holds your client credentials, your callback URLs and your OAuth scopes, so an outside system can authenticate into a Salesforce org and call the API.
The differences that matter in practice are that credentials and admin policies live in separate metadata, access is granted explicitly rather than open by default, and packaging is built for 2GP. If you want the full framework detail, including distribution states and metadata deployment, our complete External Client App guide covers it, and the connected app vs external client app comparison covers what actually changed between the two.
For getting an integration working, you do not need that depth yet. You need the app and the keys.
How do you create a connected app in Salesforce in 2 minutes?
The External Connected App tool provisions the app for you. There is no Salesforce org to set up first, no Setup screens to navigate, and no partner application to file.
The whole sequence is three screens:
- Sign in at platform.appnigma.ai/eca/login with an email code.
- Name the app, add your redirect URLs, and pick a scope preset.
- Copy your client key, secret key and managed package link.
Each step in detail below.
Step 1: Sign in with your email
One field, one code. No password to invent and no account form to fill in first. Go to platform.appnigma.ai/eca/login, enter your email, and paste the code that arrives.
Step 2: Configure the app
Name the app, add one or more redirect URLs, and choose what it can reach.
Get the redirect URL right and you avoid the most common failure in this whole process. It has to match what your code sends, character for character, including protocol, port and trailing path. A missing trailing slash is enough to break the handshake. If you are working locally, http://localhost:3000/oauth/callback is fine, and you can add staging and production URLs at the same time.
You are not locked in either way. Redirect URLs stay editable after the app exists, so you can ship to staging today and add production next week.
Step 3: Collect your keys
You get three things: a client key, a secret key and a managed package install link.
Copy the secret straight away. It is masked the moment you copy it, deliberately, so it cannot sit exposed on screen during a shared call or a screen recording. Rotate it whenever you need to.
The client key is your OAuth client_id and the secret key is your client_secret. Store the secret in a secret manager, never in your repository.
The managed package link is the part people skim past. Every app comes with an install link ready to hand to customers, which is what you need when the integration ships as something they install rather than something you host.
Which OAuth scopes should you pick?
Three scopes come with every app: API access, refresh tokens and browser sessions. The other ten are yours to add, as a preset or one at a time. Thirteen in total.
| Preset | Count | Scopes | Best for |
|---|---|---|---|
| Data only | 3 | api, refresh_token, web | Backend syncs and scheduled jobs. Moves records in and out and refreshes its own tokens. Never learns who the user is. |
| Data plus sign-in | 7 | adds openid, profile, email, offline_access | Products where people log in with their CRM account. Records, plus who is asking. |
| Full access | 13 | adds address, phone, content, custom_permissions, wave_api, eclair_api | Moving fast while prototyping. Covers analytics, CMS content and maps. |
Take the narrowest preset that does the job. Full access is the quickest way to stop fighting permission errors while you are building, but narrow it before production. An over-permissioned app is the most common finding when a customer's security team reviews your integration, and that is a far easier conversation to avoid than to win.
If none of the three fit, you can toggle any of the thirteen scopes individually.
Can you still set one up manually in Salesforce?
You can still create the app manually. It means signing up for a free Developer Edition org, waiting on the verification email, finding External Client App Manager in Setup, working out which OAuth and security settings matter, then building the managed package separately.
| Appnigma | Manual in Salesforce | |
|---|---|---|
| Salesforce org needed first | No | Yes, sign up and verify a Developer Edition org |
| Time to keys | About 2 minutes | Longer, plus the Setup learning curve |
| Setup screens | None | External Client App Manager, OAuth settings, security policies |
| Scope selection | 3 presets, or toggle 13 individually | Pick from the full Salesforce scope list unaided |
| Managed package link | Included | Build and package separately |
| Cost to start | No credit card | Free developer org, capped at 5 MB data and 15,000 API calls per 24 hours |
Neither route is wrong. If you want the manual path, our Developer Edition access guide walks through signup and the usual verification failures.
What goes wrong most often?
Redirect URL mismatches. The most common failure by a wide margin. The redirect_uri in your token request has to be identical to what you registered.
Losing the secret. It is shown once and masked after you copy it. If you close the screen without storing it, rotate and start again rather than hunting for it.
Taking full access and shipping it. Thirteen scopes is a reasonable prototyping default and a poor production one.
Testing only against clean data. Your own test org has one admin, tidy records and almost no field-level security. Customers have permission sets, restricted profiles and required custom fields. Build for that from the start.
What comes after you have the keys?
Provisioning the app is the easy day. What follows consumes the quarter: mapping objects customers have customized beyond recognition, handling API limits, building token refresh that survives a revoked grant, and passing security review if the integration ships as a packaged app.
For the token exchange itself, our walkthrough on getting an OAuth access token in Salesforce has the request shapes. The Appnigma docs cover creating an integration, generating API keys and managing OAuth connections after the handshake.
Frequently Asked Questions
Can you still create a connected app in Salesforce?
No, not by default. As of the Spring '26 release Salesforce blocks new connected app creation through both the Setup UI and the Metadata API, and admins cannot re-enable it on their own. You would need to open a case with Salesforce Support. Existing connected apps, including packaged ones, keep working normally.
What permission do I need to create a connected app in Salesforce?
None will help. This is not a permissions problem. Spring '26 disabled the creation path at the org level regardless of profile or permission set, so no permission you grant yourself will bring the button back. Create an External Connected App instead.
How do I create a connected app in Salesforce for free?
Get an External Connected App from Appnigma. Sign in with an email code, name the app, add your redirect URLs, pick a scope preset, and collect your client key and secret key. It takes about two minutes and needs no credit card and no partner application.
What is the callback URL for a Salesforce connected app?
It is the URL Salesforce sends the user back to after they authorize your app, and it has to match the redirect_uri your code sends exactly, including protocol, port and trailing path. During local development it is usually something like http://localhost:3000/oauth/callback. You can register more than one and edit them later.
Is a connected app the same as an external client app?
They do the same job of authorizing an external system over OAuth, but they are different frameworks. The external client app splits developer credentials from admin policies into separate metadata, grants access explicitly instead of leaving it open by default, and is built for 2GP packaging. It is the one you can still create.
Do I get a managed package with it?
Yes. Every app comes with a managed package install link you can hand to customers, so you are not building and packaging that separately before you can distribute the integration.
Sources
- Salesforce Help, External Client Apps
- Salesforce Developers, API Request Limits and Allocations
- Salesforce Developers, Sign up for Salesforce Developer Edition
- Trailhead, Use External Client Apps When Connected Apps Will Not Do
- Appnigma AI, Salesforce External Connected App and documentation
