Salesforce
ModerateNo review is required to let other orgs connect, but since Spring '26 new integrations are built as External Client Apps, which are local to your org unless you ship them in a 2GP managed package, and since September 2025 users can't authorize an app that isn't installed in their org without a special permission.
Agent-researched, not yet reviewed by a personResearched 2026-10-20
Working in dev
30–90 min
Signing in with your own account
Any user can connect
1–3 days
A Packaged External Client App in a self-built 2GP managed package that each customer admin installs via URL, with no AppExchange listing; an AppExchange listing adds a paid security review of several weeks.
- Waiting on
- Nothing from Salesforce for unlisted distribution. Each customer's admin installing the package (or granting the bypass permission) before their users can connect.
- Cost
- Free to build and distribute unlisted. Customers need API access (included in Enterprise, Performance, Unlimited, Developer; paid add-on for Professional). AppExchange security review is a paid, optional step for listing.
What you need first
Two free Developer Edition orgs: one with Dev Hub enabled, one with a registered namespace
A Packaged External Client App lives in a 2GP managed package, which needs a Dev Hub and a linked namespace. Enabling Dev Hub can't be undone.
The Salesforce CLI (sf)
Used to retrieve the External Client App metadata, create the package and promote package versions.
Customers on an edition with API access, with users who have the API Enabled permission
Group, Essentials and Professional editions don't include API access by default; Professional can buy it as an add-on. Calls from an org without it fail with API_DISABLED_FOR_ORG.
An HTTPS callback URL
Configured on the External Client App's OAuth settings and matched on the authorize and token calls.