Create External Client App (OAuth) — recommended over Connected App
sf_create_external_client_appCreate an External Client App (ECA) for OAuth authentication and server-to-server integrations, with configurable Client Credentials Flow and Agent API scopes, deployed via Metadata API in a single call.
Instructions
Creates an External Client App (ECA), Salesforce's newer replacement for Connected Apps, for OAuth authentication and server-to-server integrations. Prefer this over sf_create_connected_app: on ECAs, Client Credentials Flow — including which user it runs as — is fully configurable via this tool (enableClientCredentialsFlow + clientCredentialsFlowUser), whereas on classic Connected Apps that same setting can only be picked in Setup UI. Deploys all 3 underlying metadata records (ExternalClientApplication, ExtlClntAppOauthSettings, ExtlClntAppOauthConfigurablePolicies) in one call. Use 'Chatbot' and/or 'SFApiPlatform' scopes for any app that needs to call the Salesforce Agent API (e.g. testing an Agentforce agent's conversation flow) or a bot's Messaging API. NOTE: the Consumer Key/Secret this app needs to actually mint a token can still only be viewed once in Setup → External Client Apps → [name] → Settings → OAuth Settings — no Salesforce API exposes it, for either app type.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| label | Yes | Display label | |
| scopes | Yes | OAuth scopes to request, using Salesforce's exact enum literals (PascalCase — this is the ExtlClntAppOauthSettings.commaSeparatedOauthScopes enum, unrelated to the lowercase OAuth2 scope-string convention). 'Chatbot' and/or 'SFApiPlatform' are what an Agent API caller needs. 'Api' covers general REST/SOQL access. 'RefreshToken' is required for any non-client-credentials flow to get a refresh token. | |
| fullName | Yes | External Client App API name, e.g. 'My_External_App'. Used for all three underlying metadata records (ExternalClientApplication, ExtlClntAppOauthSettings, ExtlClntAppOauthConfigurablePolicies) — this tool creates all three in one call. | |
| description | No | Description | |
| contactEmail | Yes | Contact email for the app | |
| ipRelaxationPolicyType | No | IP restriction enforcement for this app's OAuth tokens. | |
| refreshTokenPolicyType | No | Refresh token expiry strategy. | |
| permittedUsersPolicyType | No | Who can authorize this app. AdminApprovedPreAuthorized (recommended for Client Credentials Flow) restricts use to explicitly pre-authorized profiles/permission sets. Defaults to Salesforce's own default (AllSelfAuthorized) if omitted. | |
| clientCredentialsFlowUser | No | Username to run Client Credentials Flow requests as (e.g. 'admin@myorg.com'). Required by Salesforce if enableClientCredentialsFlow is true. This IS settable via the Metadata API for External Client Apps — unlike classic Connected Apps, where the same 'Run As' user can only be picked in Setup UI. | |
| enableClientCredentialsFlow | No | Sets isClientCredentialsFlowEnabled=true on ExtlClntAppOauthConfigurablePolicies. |