Update security controls in Connected Apps and ECAs before May 11th, 2026. Explore the new AgentExchange, a marketplace unifying AppExchange, AgentExchange, and Slack Marketplace.
- Secure Your Connected App and External Client App Solutions
All AgentExchange Partners must follow new security requirements for Connected App (CA) and External Client App (ECA) solutions to ensure the highest level of trust and security for Customer Data. These requirements apply to any Connected App or External Client App that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs. These updates include mandatory Proof Key for Code Exchange (PKCE) and Refresh Token Rotation (RTR) enablement to prevent authorization code interception and token theft. Implementing these standards ensures these CAs or ECAs meet the latest Salesforce security protocols and safeguard Customer Data. Failure to comply may result in the Partner Application’s AgentExchange de-listing and/or Salesforce’s temporary or permanent suspension of the Partner Application’s interoperation with Salesforce’s services. - Find Solutions Faster with the New AgentExchange
Introducing the new AgentExchange, a unified destination for agents, apps, and experts across Salesforce and Slack. We’ve combined AppExchange, AgentExchange, and Slack Marketplace into a single solution engine to help you find and deploy tools faster. New semantic search capabilities and personalized recommendations within Agentforce Builder help you discover the right solutions for your specific business needs. - Recall a Sent Offer with Withdraw Offer
Partners can now withdraw a private offer after sending it to a customer, but before the customer accepts or rejects it. Use Withdraw Offer when your pricing has changed, terms need updating, or an offer went to the wrong customer. When a partner withdraws an offer, the status changes to Withdrawn in both the partner org and the customer org, and the customer can’t act on it. - Publish Agentforce Solutions with MCP Servers on AgentExchange
Help customers understand your Agentforce solutions by detailing your preconfigured Model Context Protocol (MCP) servers on AgentExchange. You can specify the number of MCP servers in your solution and add details about the tools and resources they contain. These details help customers understand what your MCP servers offer and how they enable Agentforce agents to interact with internal and external tools and resources. - Share Your Security Excellence with a Partner Trust Center
Showcase your security excellence to buyers by adding a dedicated link to your trust center on your AgentExchange listings. Adding a direct link to your security center builds credibility with customers and prevents delays in the sales cycle. The link appears on the listing page under Provider Details in the Overview tab and in the More Details tab under Need Help? - Verify Your Email-Sending Domain for Trialforce Branded Email Sets
Starting July 18, 2026, you must have a verified email-sending domain in order to publish a new Trialforce branded email set. If you have existing branded email sets, verify your email-sending domains before November 10, 2026 to continue sending system welcome emails from your custom branded email addresses. This requirement ensures compliance with a Salesforce security enhancement for outbound email. - Protect Your Customers with Up-to-Date Security Contacts
Give your customers faster protection during security events by keeping verified security contacts on file for your AgentExchange listings. All ISV partners must now designate contacts in the Partner Console, keep them up to date, and confirm them every six months. Salesforce Product Security uses this information solely for incident response. - Salesforce Enforces Security Reviews for Private AgentExchange Listings
To ensure the highest level of trust and protection for customers, solutions can't be installed from private or unpublished AgentExchange listings until the solutions have passed the Salesforce security review. The install and demo buttons are disabled on listing pages with unreviewed solutions. - Create AgentExchange Listings Faster with LLM-Assisted Authoring
Generate accurate listing content in minutes with LLM-Assisted Authoring in the Partner Console. When you create or update a listing, AgentExchange provides the option to analyze your package. The LLM reviews metadata, schema, and Agentforce artifacts like topics, actions, and prompts, and then and drafts listing fields for you to review, refine, and publish. Every field is editable, and nothing publishes until you approve it. - List and Publish MCP Servers in Agentforce Extension Packages
Show Model Context Protocol (MCP) servers in your Agentforce Extension Package on your AgentExchange listings. After you complete your listings, buyers can view the servers and tools along with your agents and actions before installing. - Showcase Your Expertise with a Redesigned Consultant Listing on AgentExchange
Show buyers a clear, up-to-date picture of your team's strengths, specializations, and recent track record with redesigned AgentExchange consultant listing pages. Listing metrics now focus on your current capabilities and recent project history instead of lifetime counts.