Introduction
Ever logged into an app using Google or Facebook without entering your password? That frictionless login experience is powered by OAuth 2.0, a modern security protocol.
In Salesforce, OAuth 2.0 enables external systems to access Salesforce data without sharing passwords, making integrations more secure, scalable, and user-controlled.
And now, Salesforce is evolving, shifting from Connected Apps to the new, more secure External Client Apps (ECA).
This guide explains OAuth 2.0 in Salesforce in the simplest possible way, updated fully to reflect ECA.
What is OAuth 2.0?
OAuth 2.0 is an industry-standard authorization framework that allows one system to access another system’s data securely using tokens instead of passwords.
It is used everywhere, mobile apps, SaaS platforms, SSO systems, and APIs.
Why OAuth 2.0 Matters in Salesforce
Salesforce integrates with:
- Mobile apps
- Web apps
- ERP systems
- Marketing automation tools
- Custom enterprise platforms
Since these apps exchange sensitive CRM data, OAuth 2.0 ensures:
✔ Secure authentication ✔ Controlled access ✔ No password sharing ✔ Compliance with security standards
How OAuth 2.0 Works in Salesforce
OAuth involves three core components:
- Authorization Server Salesforce itself, verifies identities and issues access tokens.
- Resource Server Salesforce where data lives (records, APIs, objects).
- Client Application The external system that wants to access Salesforce (a SaaS tool, backend app, etc.).
Simple Example:
- App requests permission
- Salesforce asks user to approve
- Salesforce gives a secure access token
- App uses token to call Salesforce APIs
🔥 Passwords are never shared. Tokens handle everything.
Different OAuth 2.0 Flows in Salesforce
Salesforce supports multiple OAuth flows depending on the use case:
- Authorization Code Flow
- Client Credentials Flow
- Username-Password Flow
- JWT Bearer Token Flow
- Device Flow
- SAML Bearer Assertion Flow
Each flow balances security and simplicity differently.
⭐ What is an External Client App (ECA) in Salesforce? (Updated Requirement)
Salesforce is moving away from Connected Apps and replacing them with External Client Apps (ECA), the new framework for OAuth configurations.
An ECA is where you configure OAuth settings such as:
- Who can connect
- What data they can access
- Token settings
- Policies & SSO
- API scopes
👉 If you are building any OAuth integration today, use ECA instead of Connected Apps.
Steps to Configure OAuth 2.0 in Salesforce (Using ECA)
- Go to Setup → App Manager
- Click New External Client App (ECA)
- Enable OAuth Settings
- Add Callback URL
- Select OAuth Scopes
- Save and configure policies
Use the generated Client ID & Client Secret in your app.
OAuth 2.0 Scopes in Salesforce
Scopes define access levels:
- API
- Refresh Token
- Web
- Full
Tokens in OAuth 2.0
- Access Token, short-lived
- Refresh Token, long-lived
If compromised, tokens can be revoked instantly.
Security Best Practices
✔ Use Authorization Code or JWT flows ✔ Avoid Username-Password flow ✔ Rotate secrets ✔ Enforce SSL/TLS ✔ Least privilege access
Real-World Use Cases of OAuth 2.0 in Salesforce
| Use Case | Best Flow |
|---|---|
| Web app login | Authorization Code + PKCE |
| Server-to-server | JWT or Client Credentials |
| Mobile apps | Authorization Code + PKCE |
| IoT | Device Flow |
| Enterprise SSO | SAML Bearer Flow |
Common OAuth Errors & Fixes
- Invalid callback URL → Fix in ECA
- Invalid grant → Token expired
- Invalid client → Wrong ID/secret
- Insufficient scopes → Add in ECA
Benefits of OAuth 2.0 in Salesforce Integration
- No password sharing
- Strong governance
- Smooth communication
- User-controlled permissions
- Standardized authorization
- Future-proof integrations
OAuth vs Basic Authentication
OAuth is significantly more secure and recommended.
Conclusion
Salesforce relies on OAuth 2.0 to provide secure, modern, password-less integration across systems.
With External Client Apps replacing Connected Apps, Salesforce integrations are becoming more secure and enterprise-ready.
If you're building any Salesforce integration: OAuth 2.0 is the foundation.
FAQs
- Is OAuth 2.0 required in Salesforce? Yes, almost all integrations need OAuth.
- Which flow for a web application? Authorization Code Flow with PKCE.
- Do I need an ECA? Yes: Connected Apps are being replaced.
- How long do access tokens last? Minutes, based on org policy.
- What if a token is compromised? Admins can revoke instantly.
