From jaganpro-sf-skills-7
Configures Salesforce Connected Apps and External Client Apps for OAuth flows, JWT bearer auth, PKCE, scopes, and callback setups. Activates on .connectedApp-meta.xml or .eca-meta.xml files.
npx claudepluginhub jaganpro/sf-skillsThis skill is limited to using the following tools:
Use this skill when the user needs **OAuth app configuration** in Salesforce: Connected Apps, External Client Apps (ECAs), JWT bearer setup, PKCE decisions, scope design, or migration from older Connected App patterns to newer ECA patterns.
CREDITS.mdLICENSEREADME.mdassets/connected-app-basic.xmlassets/connected-app-canvas.xmlassets/connected-app-jwt.xmlassets/connected-app-oauth.xmlassets/eca-global-oauth.xmlassets/eca-oauth-settings.xmlassets/eca-policies.xmlassets/external-client-app.xmlreferences/example-usage.mdreferences/migration-guide.mdreferences/oauth-flows-reference.mdreferences/security-checklist.mdreferences/testing-validation-guide.mdGuides Salesforce security for Connected Apps, OAuth scopes, integration users, credential storage, and field-level security. Use when securing API access or auditing configurations.
Provides Salesforce integration architecture and scoring checklists for Named Credentials, External Services, REST/SOAP callouts, Platform Events, and CDC.
Provides expert patterns for Salesforce development: LWC with wire service and reactive data, bulkified Apex triggers and classes, REST/Bulk APIs, Connected Apps, Salesforce DX scratch orgs and 2GP.
Share bugs, ideas, or general feedback.
Use this skill when the user needs OAuth app configuration in Salesforce: Connected Apps, External Client Apps (ECAs), JWT bearer setup, PKCE decisions, scope design, or migration from older Connected App patterns to newer ECA patterns.
Use sf-connected-apps when the work involves:
.connectedApp-meta.xml or .eca-meta.xml filesDelegate elsewhere when the user is:
| If the need is... | Prefer |
|---|---|
| simple single-org OAuth app | Connected App |
| new development with better secret handling | External Client App |
| multi-org / packaging / stronger operational controls | External Client App |
| straightforward legacy compatibility | Connected App |
Default guidance:
Ask for or infer:
Decide whether a Connected App or ECA is the better long-term fit.
| Use case | Default flow |
|---|---|
| backend web app | Authorization Code |
| SPA / mobile / public client | Authorization Code + PKCE |
| server-to-server / CI/CD | JWT Bearer |
| device / CLI auth | Device Flow |
| service account style app | Client Credentials (typically ECA) |
Use the provided assets instead of building from scratch:
assets/connected-app-basic.xmlassets/connected-app-oauth.xmlassets/connected-app-jwt.xmlassets/external-client-app.xmlassets/eca-global-oauth.xmlassets/eca-oauth-settings.xmlassets/eca-policies.xmlIf you need source-controlled ECA OAuth security metadata, retrieve it from an org first and treat the retrieved file as the schema source of truth:
sf project retrieve start --metadata ExtlClntAppOauthSecuritySettings:<AppName> --target-org <alias>Favor:
Before handoff, confirm:
Avoid these anti-patterns:
| Anti-pattern | Why it fails |
|---|---|
| wildcard / overly broad callback URLs | token interception risk |
Full scope by default | unnecessary privilege |
| PKCE disabled for public clients | code interception risk |
| consumer secret committed to source | credential exposure |
| no rotation / cert strategy for automation | brittle long-term ops |
Default fix direction:
Usually lives under:
force-app/main/default/connectedApps/Current source-supported ECA metadata uses multiple top-level source directories, not a single externalClientApps/ folder:
force-app/main/default/externalClientApps/ → ExternalClientApplication (.eca-meta.xml)force-app/main/default/extlClntAppGlobalOauthSets/ → ExtlClntAppGlobalOauthSettings (.ecaGlblOauth-meta.xml)force-app/main/default/extlClntAppOauthSettings/ → ExtlClntAppOauthSettings (.ecaOauth-meta.xml)force-app/main/default/extlClntAppOauthSecuritySettings/ → ExtlClntAppOauthSecuritySettings (.ecaOauthSecurity-meta.xml)force-app/main/default/extlClntAppOauthPolicies/ → ExtlClntAppOauthConfigurablePolicies (.ecaOauthPlcy-meta.xml)force-app/main/default/extlClntAppPolicies/ → ExtlClntAppConfigurablePolicies (.ecaPlcy-meta.xml)Important file-name gotchas:
.ecaGlblOauth, not .ecaGlobalOauth.ecaPlcy, not .ecaPolicy.ecaOauthSecurity for ExtlClntAppOauthSecuritySettingsWhen finishing, report in this order:
Suggested shape:
App: <name>
Type: Connected App | External Client App
Flow: <oauth flow>
Files: <paths>
Security: <scopes, PKCE, certs, secrets, IP policy>
Next step: <deploy, retrieve consumer key, or test auth flow>
| Need | Delegate to | Reason |
|---|---|---|
| Named Credential / callout runtime config | sf-integration | runtime integration setup |
| deploy app metadata | sf-deploy | org validation and deployment |
| Apex token or refresh handling | sf-apex | implementation logic |
| permission review after deployment | sf-permissions | access governance |
| Score | Meaning |
|---|---|
| 80+ | production-ready OAuth app config |
| 54–79 | workable but needs hardening review |
| < 54 | block deployment until fixed |