Integration Connectivity Connected App Configure

This is the skill you reach for when you're wiring up OAuth between Salesforce and external systems. It covers both Connected Apps and the newer External Client Apps, helps you pick the right OAuth flow (JWT bearer, PKCE, device flow, etc.), and walks you through the various metadata files that live in different directories. The 120-point security checklist is solid and opinionated in the right ways: no full scope by default, PKCE for public clients, never commit secrets. Worth noting that as of Spring '26, new Connected Apps are disabled by default in fresh orgs, so you'll be working with ECAs more often. The templates are comprehensive and the gotchas section actually covers the weird file suffix abbreviations that will break your deployments if you guess wrong.

skills.sh installs: 5.5K
GitHub stars: 1.2K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add forcedotcom/sf-skills --skill integration-connectivity-connected-app-configure --agent claude-code

Installs into .claude/skills of the current project.

Files

integration-connectivity-connected-app-configure: Salesforce Connected Apps & External Client Apps

Use this skill when the user needs OAuth app configuration in Salesforce: Connected Apps, External Client Apps (ECAs), JWT bearer setup, PKCE decisions, scope design, or migration from older Connected App patterns to newer ECA patterns.

Scope

In scope:

.connectedApp-meta.xml or .eca-meta.xml files
OAuth flow selection and callback / scope setup
JWT bearer auth, device flow, client credentials, or auth-code decisions
Connected App vs External Client App architecture choices
Consumer key / secret / certificate handling strategy

Out of scope — delegate elsewhere:

Configuring Named Credentials or runtime callouts → integration-connectivity-generate
Deploying metadata to orgs → the platform-metadata-deploy skill
Writing Apex token-handling code → the platform-apex-generate skill