Salesforce API Authorization and Client-App Onboarding

Overview

Choose the app and OAuth model, establish least privilege, and prove read-only access without defaulting to legacy username-password automation.

Prerequisites

• Target org, edition, domain, environment, integration purpose, and data classes
• Identity, security, Salesforce administration, application, and support owners
• Current org policy and first-party OAuth documentation

Tool Discipline

Use Read, Glob, and Grep to inspect approved repository and evidence files, WebFetch to re-check current first-party Salesforce documentation, and Write or Edit only for secretless plans, fixtures, configuration, and redacted receipts.

Current Contract

Salesforce REST API supports OAuth through External Client Apps or Connected Apps. Creating Connected Apps is restricted as of Spring '26; existing Connected Apps can continue, while Salesforce recommends External Client Apps for new integrations.