---
schema_version: "1"
id: 334ff59ae5167dce005ec7990dfe546958595e80b9c73372e2e41f745ea26c48
title: Create a Custom Connected App Handler
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_create_custom_handler.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_custom_handler.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a161b10992b3194ed54ecd0b6821a7cc57965c734b7d8c85e8473635342e7aee
description: Write a custom connected app handler in Apex to customize the behavior of a connected app. The custom handler can support new protocols or respond to user attributes in a way that benefits a business process.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Create a Custom Connected App Handler

Write a custom connected app handler in Apex to customize the behavior of a connected app. The custom handler can support new protocols or respond to user attributes in a way that benefits a business process.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d37429e64">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">To read, create, update, or delete connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">To rotate the consumer key and consumer secret:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">Allow consumer key and secret rotation</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">To install and uninstall connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">To install and uninstall packaged connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37429e64 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data
                OR Manage Connected Apps</p>
            </td>
          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

1. Create a class that extends the `ConnectedAppPlugin` Apex class, and associate it with the connected app. See the `ConnectedAppPlugin` class in the [Apex Reference Guide](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_ConnectedAppPlugin.htm#apex_class_Auth_ConnectedAppPlugin).
2. Create your connected app, and complete its [basic information](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_basics.htm&release=264.0.0&type=5 "For all connected apps, define the basics, which include the app’s name, logo, and contact information.").
3. For Apex Plugin Class, enter the name of the Apex class you created to customize the behavior of the connected app.
4. For Run As, select a user account to be the execution user. The plug-in runs as the execution user on behalf of the current user of the connected app. Depending on the methods used in your `ConnectedAppPlugin` Apex class, you can sometimes leave this field blank.
    1. If your Apex class uses the `authorize`, `modifySAMLResponse`, or `refresh` methods, specify an execution user in the Run As field.
    2. If your class uses only the `customAttributes` method and doesn't invoke any other `ConnectedAppPlugin` methods, you can optionally leave the Run As field blank. The plug-in then runs as an Automated Process User, which is a system user that executes tasks behind the scenes.
5. Save your settings.