OAuth 2.0 Connected Apps for Secure Salesforce Integration

Secure Salesforce integration is a necessity for organizations that rely on Salesforce to power customer relationships, automate workflows, and connect enterprise applications.

Whether you’re integrating ERP systems, marketing automation platforms, custom applications, or third-party business tools, ensuring secure authentication is the foundation of every successful integration.

Salesforce uses OAuth 2.0 Connected Apps to provide secure, token-based authentication without exposing user credentials. Instead of storing usernames and passwords, Connected Apps generate secure access tokens that allow authorized applications to communicate safely with Salesforce APIs.

In this guide, you’ll learn how OAuth 2.0 Connected Apps work, why they matter, how to configure them correctly, and the security best practices every organization should follow. You’ll also discover when partnering with an experienced Salesforce consulting partner can help accelerate implementation and ensure your integration aligns with enterprise security standards.

What Is a Salesforce Connected App?

Why OAuth 2.0 Matters for Salesforce Integration

How OAuth 2.0 Connected Apps Work

Benefits of Using OAuth 2.0 Connected Apps

Step-by-Step Guide to Configure a Connected App

Choosing the Right OAuth Flow

Salesforce Integration Security Best Practices
Common Integration Mistakes to Avoid

How to Use OAuth 2.0 Connected Apps for Secure Salesforce Integration

What Is a Salesforce Connected App?

A Salesforce Connected App acts as the identity gateway between Salesforce and an external application. It enables third-party systems, mobile applications, middleware platforms, and custom-built software to securely access Salesforce APIs using OAuth 2.0 authentication.

When a Connected App is created, Salesforce generates two important credentials:

Consumer Key

Consumer Secret

These credentials uniquely identify the external application during authentication and enable secure communication without sharing user passwords. Connected Apps also allow administrators to configure OAuth scopes, session policies, IP restrictions, refresh token settings, and admin approvals for greater control over API access.

Why OAuth 2.0 Matters for Salesforce Integration

Traditional integrations often relied on usernames and passwords, creating security vulnerabilities and making credential management difficult. OAuth 2.0 solves these problems by replacing passwords with secure access tokens.

Instead of exposing login credentials:

Users authorize applications once.

Salesforce issues secure access tokens.

Applications use these tokens for API requests.

Refresh tokens automatically generate new access tokens when required.

This token-based approach significantly reduces the risk of credential theft while providing a secure, scalable authentication framework suitable for enterprise environments.

How OAuth 2.0 Connected Apps Work

The most used authentication mechanism is the Authorization Code (Web Server) Flow. The process follows these steps:

Step 1: User Authentication: The external application redirects users to Salesforce’s authorization endpoint.

Step 2: User Approval: The user logs into Salesforce and grants permission to the Connected App.

Step 3: Authorization Code: Salesforce redirects the user back to the configured callback URL with a temporary authorization code.

Step 4: Token Exchange: The application’s backend exchanges the authorization code along with the Consumer Key and Consumer Secret for:

Access Token

Refresh Token

Step 5: API Access: The application uses the access token to securely access Salesforce APIs.

Step 6: Token Refresh: When the access token expires, the refresh token obtains a new access token without requiring users to log in again.

Benefits of Using OAuth 2.0 Connected Apps

Organizations choose OAuth 2.0 Connected Apps because they provide multiple advantages:

Enhanced Security: No passwords are stored within external applications.

Better Access Control: Administrators define exactly what applications can access using OAuth scopes.

Enterprise Scalability: Connected Apps support web applications, mobile apps, middleware, and server-to-server integrations.

Improved Compliance: Audit logs, permission policies, and admin approvals simplify compliance with security regulations.

Seamless User Experience: Single Sign-On (SSO) and refresh tokens eliminate repeated authentication.

Step 1: Create a Connected App in Salesforce

Step 1.1: Navigate to App Manager – From Salesforce Setup, navigate to Setup → Apps → App Manager, then click New Connected App in the top-right corner.

Step 1.2: Fill in Basic Information – Provide the following basic details for your Connected App:

Connected App Name — A descriptive name, such as My Integration App.

API Name — Automatically populated based on the Connected App name.

Contact Email — Required for app management, support, and notifications.

Step 1.3: Enable OAuth Settings – Select the Enable OAuth Settings checkbox. This displays the OAuth configuration fields required for authentication.

Configure the following:

Callback URL — The redirect URI where your application receives the authorization response after login. This URL must exactly match the redirect URI used in your authorization request.

Selected OAuth Scopes — Move the required permissions into Selected OAuth Scopes, such as:

Manage user data via APIs (api)

Perform requests at any time (refresh_token, offline_access)

Access unique user identifiers (openid)

Step 1.4: Save and Continue

Click Save. Salesforce displays a notice that the changes may take 2–10 minutes to propagate. This is normal.

Step 2 — Retrieve Your Consumer Key and Consumer Secret

After saving the Connected App, open its detail page and click Manage Consumer Details. You may be prompted to verify your identity.

Copy the Consumer Key (your OAuth client_id) & Consumer Secret (your OAuth client_secret). Store the Consumer Secret securely and treat it like a password. Never commit it to source control or expose it in client-side code.

Step 3 — Configure Connected App Policies (Optional but Recommended)

Under Manage on the Connected App, you can configure additional security and access policies.

Permitted Users — Select “Admin approved users are pre-authorized” for tighter access control, or “All users may self-authorize” for broader access.

IP Relaxation — Relax IP restrictions if your integration runs from trusted server IP addresses.

Refresh Token Policy — Configure the refresh token expiration policy, such as “Valid until revoked” or “Expire after a specified period of inactivity.”

Step 4 — Build the Authorization Request

From your application, redirect the user’s browser to the authorization endpoint with your client ID, redirect URI, and requested scopes:

GET https://login.salesforce.com/services/oauth2/authorize

?response_type=code

&client_id=YOUR_CONSUMER_KEY

&redirect_uri=https://yourapp.com/oauth/callback

&scope=api%20refresh_token%20offline_access

Use https://test.salesforce.com instead of login.salesforce.com if you’re authenticating against a sandbox org.

Step 5 — Exchange the Authorization Code for Tokens

Salesforce redirects back to your callback URL with a code parameter. Your backend exchanges it server-side:

POST https://login.salesforce.com/services/oauth2/token

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code

&code=AUTHORIZATION_CODE

&client_id=YOUR_CONSUMER_KEY

&client_secret=YOUR_CONSUMER_SECRET

&redirect_uri=https://yourapp.com/oauth/callback

A successful response looks like this:

{

“access_token”: “00D…”,

“refresh_token”: “5Aep…”,

“instance_url”: “https://yourorg.my.salesforce.com“,

“id”: “https://login.salesforce.com/id/00D…/005…”,

“token_type”: “Bearer”,

“issued_at”: “1719753600”,

“signature”: “…”

}

Store the refresh_token securely and associate it with the user/org. The instance_url tells you which Salesforce instance to send future API calls to.

Step 6 — Call the Salesforce REST API

Use the access token as a Bearer token against the instance URL returned above:

GET {instance_url}/services/data/v60.0/sobjects/Account/001XXXXXXXXXXXX

Authorization: Bearer 00D…ACCESS_TOKEN

Step 7 — Refresh Expired Access Tokens

Access tokens expire. Use the refresh token to get a new one without re-prompting the user:

POST https://login.salesforce.com/services/oauth2/token

Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token

&client_id=YOUR_CONSUMER_KEY

&client_secret=YOUR_CONSUMER_SECRET

&refresh_token=YOUR_REFRESH_TOKEN

Troubleshooting Common Errors

redirect_uri_mismatch – The redirect_uri in your request must match the Callback URL in the Connected App exactly — including trailing slashes and http vs. https.

invalid_client_id – Double check you’re using the Consumer Key (not the Connected App name) and that you copied it without extra whitespace.

invalid_grant – Usually means the authorization code was already used (codes are single-use) or has expired (codes are valid for a few minutes only).

“This app isn’t approved by your org’s admin”

Happens when Permitted Users is set to “Admin approved users are pre-authorized.” Add the user to a permission set tied to the Connected App, or relax the policy for testing.

Choosing the Right OAuth Flow

Salesforce supports multiple OAuth 2.0 flows. The most common include:

OAuth Flow

Best For

Authorization Code Flow

Web applications

JWT Bearer Flow

Server-to-server integrations

Client Credentials Flow

Machine-to-machine communication

Device Flow

IoT devices

User-Agent Flow

Browser-based applications

Selecting the appropriate flow depends on your application’s architecture and security requirements. Connected Apps support several OAuth flows, including Web Server, JWT Bearer, Device, Client Credentials, and User-Agent flows.

Salesforce Integration Security Best Practices

Never expose Consumer Secrets in frontend applications.

Always use HTTPS callback URLs.

Apply the principle of least privilege.

Restrict OAuth scopes.

Encrypt refresh tokens.

Rotate Consumer Secrets regularly.

Require admin approval for sensitive integrations.

Monitor Connected App usage.

Review audit logs frequently.

Apply IP restrictions whenever possible.

Conclusion

Secure Salesforce integration starts with proper authentication, and OAuth 2.0 Connected Apps provide the trusted framework organizations need to protect sensitive business data while enabling seamless connectivity. By replacing passwords with secure access tokens, applying least-privilege access, and following Salesforce security best practices, businesses can build scalable, reliable, and compliant integrations.

Whether you’re connecting a custom application, enterprise middleware, or cloud platform, implementing OAuth 2.0 correctly is critical to long-term success. For organizations managing complex ecosystems, partnering with an experienced Salesforce consulting partner can simplify deployment, reduce security risks, and maximize the value of Salesforce consulting services through proven implementation strategies and ongoing optimization.