Salesforce Connected Apps best practices are essential for building secure, scalable, and well-governed integrations between Salesforce and external applications. Whether your organization connects Salesforce to an ERP system, HubSpot, a customer portal, or a custom application, properly configured Connected Apps help protect sensitive data, simplify administration, and reduce long-term security risks.

A poorly configured Connected App can expose unnecessary API access, grant excessive permissions, and make integration management increasingly difficult as your Salesforce environment grows. Following proven best practices helps organizations improve security, maintain compliance, and create integrations that are easier to support over time.

While Connected Apps remain fully supported, Salesforce now recommends evaluating External Client Apps for many new inbound integrations. Existing Connected Apps continue to power thousands of production environments, making it important for administrators, developers, and architects to understand how to configure and manage them correctly.

In this guide, you’ll learn Salesforce Connected Apps best practices, common configuration mistakes, governance recommendations, and practical implementation tips based on Salesforce security guidance and enterprise integration patterns.

If you’re looking for OAuth implementation guidance, our Salesforce OAuth 2.0 Best Practices article explains authentication flows, token management, and security recommendations in greater detail.

Salesforce Connected App Overview

A Salesforce Connected App is a framework that enables external applications to securely authenticate with Salesforce and access platform resources through standardized identity protocols and APIs.

Connected Apps support technologies such as:

• OAuth 2.0
• OpenID Connect
• SAML
• Salesforce REST API
• Salesforce Bulk API 2.0
• Mobile SDK

Once configured, a Connected App defines how an external application authenticates, what permissions it receives, and which Salesforce APIs it can access.

Typical use cases include:

• HubSpot integrations
• ERP systems
• customer portals
• mobile applications
• internal enterprise applications
• custom web applications

Salesforce provides detailed documentation covering Connected Apps, authentication methods, and configuration options.

Why Salesforce Connected Apps Matter

Almost every Salesforce implementation eventually requires integration with external systems.

Common examples include:

• synchronizing marketing platforms;
• connecting ERP software;
• enabling customer self-service portals;
• building mobile applications;
• integrating internal business systems;
• connecting third-party SaaS platforms.

Without Connected Apps, organizations would need to rely on less secure authentication methods or implement custom authentication mechanisms.

Connected Apps provide centralized management for:

• authentication;
• authorization;
• API access;
• security policies;
• user permissions;
• integration governance.

They also make it easier to monitor, audit, and control how external applications access Salesforce resources.

Before designing a Connected App strategy, it’s also important to understand the broader Salesforce integration landscape. Our Salesforce Data Integration: 7 Methods & Best Practices guide explains when to use APIs, middleware, ETL tools, Salesforce Flow, and other integration approaches.

Salesforce Connected Apps and External Client Apps

Salesforce continues to support Connected Apps, but its integration architecture has evolved.

Recent platform updates introduced External Client Apps, a newer framework designed to improve governance for inbound integrations.

The primary difference is administrative separation.

External Client Apps separate application registration from security policy management, allowing administrators to manage authentication, permissions, and governance more independently.

However, this does not mean Connected Apps are deprecated.

Existing Connected Apps:

• remain fully supported;
• continue to power existing enterprise integrations;
• should continue to follow modern security best practices.

For most organizations, the recommendation is straightforward:

• continue managing existing Connected Apps securely;
• evaluate External Client Apps when designing new inbound integrations.

Salesforce explains this architectural evolution in its official Architect guidance.

Salesforce Connected Apps vs External Client Apps

Organizations already using Connected Apps generally do not need to migrate immediately. Instead, they should focus on securing existing integrations while evaluating External Client Apps for future projects.

Salesforce Connected App Lifecycle

Managing a Connected App does not end after it is created. A secure implementation follows a continuous lifecycle.

Plan

↓

Create Connected App

↓

Configure Policies

↓

Assign Permissions

↓

Deploy Integration

↓

Monitor Usage

↓

Audit Configuration

↓

Review and Improve

Treating Connected Apps as part of an ongoing governance process helps maintain security as integrations evolve.

Salesforce Connected Apps Best Practices

The following recommendations are based on Salesforce documentation, Salesforce Architect guidance, and enterprise implementation experience.

1. Follow the Principle of Least Privilege

One of the most important Salesforce Connected Apps best practices is granting only the permissions an integration actually requires.

Avoid assigning unnecessary OAuth scopes or administrator-level permissions simply because they are available.

Instead:

• grant only required OAuth scopes;
• assign dedicated Permission Sets;
• restrict object and field permissions where possible;
• separate administrator access from integration access.

For example, a marketing automation platform typically does not require unrestricted administrative access to Salesforce.

Applying the principle of least privilege reduces the attack surface and limits the impact of compromised credentials.

For a detailed guide to configuring permissions, see our Salesforce Connected App Permissions Best Practices article.

2. Choose the Right OAuth Flow

Salesforce supports several OAuth authentication flows, and selecting the appropriate one improves both security and maintainability.

Legacy authentication methods, such as the Username-Password Flow, should generally be avoided for new implementations unless there is a specific compatibility requirement.

For a detailed explanation of each flow, see our Salesforce OAuth 2.0 Best Practices guide.

3. Configure Connected App Policies Carefully

Connected App policies have a direct impact on the security of your Salesforce environment.

Review and configure:

• Permitted Users
• OAuth Scopes
• Refresh Token Policies
• Session Policies
• IP Relaxation Settings

For example:

• require administrator approval for sensitive integrations;
• limit refresh token lifetime where appropriate;
• restrict internal integrations to trusted IP ranges;
• configure session timeout policies according to business requirements.

Proper policy configuration significantly reduces unauthorized access while improving governance across connected applications.

4. Create Dedicated Connected Apps for Each Integration

One of the most common architectural mistakes is using a single Connected App for every external system.

❌ One Connected App

• ERP
• HubSpot
• Mobile App
• Customer Portal
• Internal Services

A better approach is:

ERP → Connected App

HubSpot → Connected App

Mobile App → Connected App

Customer Portal → Connected App

Separating Connected Apps provides:

• independent security policies;
• simpler troubleshooting;
• easier permission management;
• improved auditing;
• lower operational risk.

For example, rotating credentials for a HubSpot integration should not affect ERP or customer portal integrations.

5. Separate Connected Apps Between Environments

Production, Sandbox, and development environments should use separate Connected Apps whenever possible.

Recommended approach:

Production

↓

Production Connected App

Sandbox

↓

Sandbox Connected App

Development

↓

Development Connected App

This separation helps prevent accidental access between environments, simplifies testing, and reduces the risk of using production credentials during development.

Salesforce Connected Apps Best Practices

6. Use Dedicated Integration Users

A Connected App should never rely on a shared administrator account unless there is a specific operational requirement.

Instead, create a dedicated Integration User for each business integration.

A common but risky architecture looks like this:

❌ One System Administrator

• HubSpot
• ERP
• Customer Portal
• Mobile Application
• Internal Services

This approach creates several problems:

• excessive permissions;
• difficult troubleshooting;
• limited audit visibility;
• increased security impact if credentials are compromised.

A better architecture is:

HubSpot → Connected App → Integration User

ERP → Connected App → Integration User

Customer Portal → Connected App → Integration User

Mobile App → Connected App → Integration User

Each Integration User should receive only the Permission Sets required for its specific business function.

Benefits include:

• improved auditing;
• simpler troubleshooting;
• stronger security;
• independent permission management;
• easier credential rotation.

7. Protect Secrets, Certificates, and Tokens

Connected Apps rely on several sensitive credentials that should be protected throughout their lifecycle.

These include:

• Consumer Key;
• Consumer Secret;
• JWT certificates;
• Access Tokens;
• Refresh Tokens.

Salesforce administrators should avoid:

• storing secrets in source code;
• committing credentials to Git repositories;
• sharing Consumer Secrets between environments;
• using long-lived credentials without review.

Instead:

• store secrets in a secure secret-management solution;
• rotate Consumer Secrets periodically;
• replace certificates before expiration;
• revoke unused Refresh Tokens;
• invalidate credentials immediately after a suspected security incident.

Proper credential management significantly reduces the risk of unauthorized API access.

8. Monitor Salesforce Connected Apps Continuously

Connected Apps should be monitored throughout their lifecycle rather than only during deployment.

Administrators should regularly review:

• Login History;
• OAuth usage;
• API consumption;
• Connected App activity;
• Integration User activity;
• failed authentication attempts.

Continuous monitoring helps identify:

• inactive integrations;
• unusual authentication activity;
• unexpected API usage;
• expired credentials;
• configuration issues.

For organizations that rely heavily on APIs, monitoring API consumption is equally important. Our Salesforce API Comparison: REST vs Bulk API Guide explains how different Salesforce APIs affect scalability, performance, and API usage.

9. Audit Connected Apps Regularly

Connected Apps should be reviewed as part of a regular security and governance process.

A periodic audit should include:

• identifying unused Connected Apps;
• reviewing OAuth Scopes;
• validating Integration User permissions;
• checking Connected App policies;
• reviewing Refresh Token policies;
• confirming active business ownership.

Useful questions include:

• Is this Connected App still required?
• Are assigned permissions still appropriate?
• Does the Integration User still need access?
• Are OAuth Scopes aligned with current business requirements?
• Has this Connected App been reviewed recently?

Regular audits reduce unnecessary security risks and improve long-term maintainability.

Common Salesforce Connected App Mistakes

Even well-designed Salesforce environments can accumulate Connected App configuration issues over time.

Using One Connected App for Every Integration

Each business integration has different security requirements.

Sharing one Connected App across multiple systems creates unnecessary dependencies and makes administration more difficult.

Granting Excessive OAuth Scopes

Applications should receive only the permissions required to perform their tasks.

Avoid assigning administrator-level access when more restrictive scopes are sufficient.

Sharing Integration Users

Each integration should have its own dedicated Integration User whenever possible.

Shared accounts reduce accountability and complicate troubleshooting.

Ignoring Connected App Policies

Default configuration settings are not always appropriate for production environments.

Review:

• Permitted Users;
• Session Policies;
• Refresh Token Policies;
• IP Relaxation;
• OAuth Scopes.

Never Reviewing Existing Connected Apps

Organizations often accumulate Connected Apps that are no longer used.

Unused integrations should be identified, reviewed, and removed when appropriate.

Salesforce Connected Apps Security Checklist

Before deploying or reviewing a Connected App, verify the following:

✔ OAuth authentication is configured correctly.

✔ Only required OAuth Scopes are assigned.

✔ Dedicated Integration Users are used.

✔ Separate Connected Apps exist for separate integrations.

✔ Consumer Secrets and certificates are stored securely.

✔ Refresh Token policies are configured appropriately.

✔ API usage is monitored regularly.

✔ Connected Apps are audited periodically.

✔ Production and Sandbox environments use separate Connected Apps.

Real-World Architecture Example

Consider a company integrating Salesforce with multiple business systems.

Poor Architecture

• One Connected App
• One System Administrator account
• Shared OAuth credentials
• Full API permissions for every integration

Result:

• difficult troubleshooting;
• excessive permissions;
• increased security exposure;
• poor governance.

Recommended Architecture

HubSpot

↓

Connected App

↓

Dedicated Integration User

↓

Permission Set

↓

OAuth Authentication

↓

Salesforce

ERP

↓

Connected App

↓

Dedicated Integration User

↓

Permission Set

↓

OAuth Authentication

↓

Salesforce

Customer Portal

↓

Connected App

↓

Dedicated Integration User

↓

Permission Set

↓

OAuth Authentication

↓

Salesforce

Each integration can now be managed independently without affecting the others.

For practical implementation examples, see our HubSpot Salesforce Integration: Complete Setup Guide and Freshdesk Salesforce Integration: Complete Setup Guide articles.

Salesforce Connected Apps Best Practices Summary

Conclusion

Salesforce Connected Apps remain a fundamental component of enterprise Salesforce integrations and continue to be fully supported for existing implementations.

At the same time, Salesforce recommends evaluating External Client Apps for many new inbound integrations because they introduce a more modern governance model with improved administrative separation.

Regardless of the architecture you choose, following Salesforce Connected Apps best practices helps build integrations that are secure, scalable, and easier to maintain.

Organizations should:

• grant only the permissions an integration requires;
• choose the appropriate OAuth authentication flow;
• create dedicated Connected Apps and Integration Users;
• separate Production and Sandbox environments;
• protect secrets and certificates;
• continuously monitor Connected Apps;
• perform regular security audits.

Treating Connected Apps as part of your overall integration governance—not simply as an OAuth configuration—will improve security, simplify administration, and help your Salesforce environment adapt to future platform changes.