External Client Apps, Tokens and Their Lifecycle

Chapter 13 of Securing Salesforce: Identity and Access, Part 2: Accepting and Providing Identity, and its end. Start with chapter 8 if the food festival, scopes and the wristband are new to you.

Every OAuth flow in Part 2 went through an app: the food festival’s client credentials, the Burger House, the device on the TV, the golden pass. Whoever controls the apps controls who gets in, and what they can do with what they’re given.

And when things went wrong for Salesforce customers in 2024 and 2025, they went wrong right there: an app someone was talked into approving, or the tokens a trusted app was holding. Not the platform. The doors.

This chapter is the admin’s side of every app: what it is, who may use it, what happens to its tokens over time, and how to see and take back what’s been handed out. Integration Architect’s chapter 13, module 7, teaches the same tokens as a design decision.

The ideas in this chapter

The app is the gatekeeper: the developer’s settings travel with it; the admin’s policies stay in your org.
Connected apps, dated: new ones restricted since Spring ‘26; support ends in Summer ‘27; a button to migrate.
See every app: the Insights page and the OAuth Usage page.
Five questions for every app: who may use it, what it may do, from where, how long and how strong, which apps at all. And watch Use Any API Client.
The refresh token came for the ride: rotation catches a reused one, the idle limit expires a forgotten one, the IP allowlist pins it down, DPoP makes a stolen one useless, and you can always take it back.
The 2024–2026 incidents came through identity doors, not platform flaws: a person approving an app, a partner’s stored tokens, an identity provider account.
What’s been retired handed around a password, a live session or a token in the open.

The picture

Here’s the chapter’s picture: the two halves of every app.

Click to enlarge

The path through this chapter

Four modules, Checkpoint 2, and a practice.

The App Is the Gatekeeper Every flow went through an app; settings and policies; local or packaged; connected apps; seeing every app.
Who May Use It, and How Five questions: who, what, from where, how long and how strong, which apps at all.
The Re-Entry Pass, Over Time Rotation; the idle limit; the IP allowlist; five per person; taking it back; DPoP.
Where It Went Wrong, 2024–2026 Three doors, and what closes them; what’s been retired, and why.
Checkpoint 2: Steve Trucking Every line that reaches the API: its flow, its app, its policies, its tokens, and two bad days.

Then the practice: harden your lab apps, and watch rotation catch a thief.

Check what stuck with the study guide.

What an architect decides here

An app per line, each with the narrowest policies that still work.
Who holds Use Any API Client, and who checks the Insights page.
Rotation, the idle limit and IP allowlists on every app that needs them, old ones included.
A revoke runbook before the partner calls.
A date for every retired mechanism still in your org.

Beyond the exam: what AI changes. Agents and MCP servers are apps with tokens too, and every door in this chapter is open to them. Chapter 17 takes it further.

Explore

Each module lists its own sources, each checked 2026-11-07. Two to start with:

External Client Apps (opens in a new tab) (Salesforce Help, Winter ‘27; checked 2026-11-07)
Configure the External Client App OAuth Settings (opens in a new tab) (Salesforce Help, Winter ‘27; checked 2026-11-07)

Next: Part 3, everyone outside the company: Customers and Partners (coming soon).