How does Connected App work in Salesforce?
Connected Apps are the primary mechanism for authorizing third-party applications, mobile apps, and backend services to access Salesforce data. When you create a Connected App, Salesforce generates a Consumer Key and Consumer Secret used in OAuth 2.0 flows, including Web Server (authorization code), User-Agent (implicit), JWT Bearer Token, Device, and Client Credentials flows. The Connected App configuration controls which OAuth scopes are allowed (e.g., api, refresh_token, full, web), session policies, IP restrictions, and whether admin pre-authorization is required.
Connected Apps also support SAML for SSO integration and can be used to manage Canvas apps. Admins control access to Connected Apps through profiles and permission sets, and can set policies for refresh token expiration, session timeout, and IP relaxation. The OAuth approval history provides an audit trail of which users have authorized the app. For service-to-service integrations, the JWT Bearer flow combined with a certificate and Named Credential is the recommended pattern. Clientell AI uses a Connected App with minimal scopes for secure, admin-approved access to your org's metadata.