---
schema_version: "1"
id: 6ebade60ebe1e4767490b6554facd365d4a6f390c35e4f0e49ff39373c12775c
title: Manage Current OAuth Connected App Sessions
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_manage_current_sessions.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_current_sessions.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5ed897c860f3e21a6b27abdf0b0caac0b29c639808bd3ac4a82c6e09fbc02634
description: The Connected Apps OAuth Usage page displays current OAuth app connections. For apps that aren't installed, it also displays usage attempts that Salesforce automatically denied due to security restrictions. From this page, you can install or uninstall third-party connected apps, revoke an app’s active sessions, and block or unblock org-wide access to the app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Manage Current OAuth Connected App Sessions

The Connected Apps OAuth Usage page displays current OAuth app connections. For apps that aren't installed, it also displays usage attempts that Salesforce automatically denied due to security restrictions. From this page, you can install or uninstall third-party connected apps, revoke an app’s active sessions, and block or unblock org-wide access to the app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>

          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d76892e82">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">To view the OAuth Connected Apps Usage page:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">Customize Application AND View Setup and Configuration AND Manage Users</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">To read, create, update, or delete connected apps:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">Customize Application AND Modify All Data</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">To install and uninstall connected apps:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">To install and uninstall packaged connected apps:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76892e82 ">
              <p>Customize Application AND either</p>
              <p>Modify All Data OR Manage Connected Apps</p>
              <p style="margin-bottom:0;">AND
                Download AppExchange Packages</p>
            </td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note The OAuth 2.0 username-password flow issues one-time access tokens. As a result, connected apps that are using this flow aren’t displayed on the Connected Apps OAuth Usage page, even if they have an active session.

For security, we recommend that you block all connected apps from using the username-password flow. Use the OAuth 2.0 web server flow with Proof Key for Code Exchange (PKCE) as a more secure alternative. For steps to block the username-password flow, see [Block OAuth 2.0 Flows to Improve Security](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&release=264.0.0&type=5 "The OAuth 2.0 user-agent and username-password flows are considered insecure and aren’t recommended. For better security, we strongly recommend that you block these flows in Salesforce to prevent developers from using them to build new integrations. If your org is created in Summer ‘23 or later, the username-password flow is blocked by default. You can enable the username-password flow if needed. If you have existing integrations that use the user-agent or username-password flow, update them to a more secure OAuth 2.0 flow. You can also block the Authorization Code and Credentials Flow, which is used to securely configure a headless login process. And you can block certain flows that don’t use the PKCE extension."). For steps to use the web server flow, see [OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&release=264.0.0&type=5 "To integrate an external web app with the Salesforce API, use the OAuth 2.0 web server flow, which implements the OAuth 2.0 authorization code grant type. With this flow, the server hosting the web app must be able to protect the external client app’s identity, defined by the client ID and client secret.").

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_tip.png)

Tip Setup with Agentforce can help you manage connected app sessions. For more information, see [Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_overview.htm&language=en_US) and [Identity Management in Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_identity.htm&language=en_US).

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note API calls can be made using connected apps even if the app isn’t installed in your org. Some connected apps are globally registered in Salesforce’s identity infrastructure. These apps exist externally and authenticate via OAuth, relying on your org’s policies to permit access.

1. From Setup, in the Quick Find box, enter OAuth, and then select **Connected Apps OAuth Usage**.
    
    The resulting list of apps can be long because it contains all Salesforce and custom OAuth apps available to your users, not just the ones installed in your org. For example, it lists third-party apps from AppExchange and Salesforce partners.
    
    For apps that aren't installed, you can review the number of usage attempts that Salesforce [automatically denied](https://help.salesforce.com/s/articleView?id=005132365&type=1&language=en_US). For these apps, Salesforce denies usage if a user doesn't have the "Approve Uninstalled Connected Apps" user permission. Denied attempts can sometimes indicate that a user is trying to use an app with a legitimate use case. If you trust the app, allow usage by clicking **Install**. Denied attempts can also indicate that someone tried to connect a suspicious app. To tighten security, end all sessions and prevent new sessions by clicking **Block**.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note Connected app sessions can expire when a new Salesforce major release takes effect. To avoid disruptions, start a new session after a major release. To see major release dates for your instance, go to [Trust Status](https://status.salesforce.com/), search for your instance, and click the maintenance tab.
2. To open the detail page for the connected app, click **Manage App Policies**. From the detail page, you can click **Edit Policies** to manage the app’s access policies. See [Manage Access to a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage.htm&release=264.0.0&type=5 "After a connected app is installed in your org, you can manage access to it. Configure permissions and policies for the app, explicitly defining who can use the connected app and where they can access the app from. These permissions and policies, which include user-access, IP range restrictions, and multi-factor authentication (MFA), provide extra security for your org.").
3. To open the Connected Apps User’s Usage page to see information about users, click a user count number. User information includes:
    
    - When they first used the app
    - Most recent time they used the app
    - Total number of times they used the app
    
    From this page, you can end a user’s access to the current session by clicking **Revoke**. At the top of the page, click **Revoke All** to end all current sessions for the app.
4. To install a third-party app, click **Install**. With the app installed, you can manage its access policies. See [Install a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_how_to_install.htm&release=264.0.0&type=5 "You install a connected app by installing a managed package that includes the connected app as a component. For example, ISVs package connected apps to make them available on AppExchange. You can also install an OAuth connected app from the Connected Apps OAuth Usage page. This page lists all OAuth connected apps that users in your org are connecting to currently—including apps that developers created in other Salesforce orgs.").
5. To remove your local copy of an installed connected app, click **Uninstall**. Before uninstalling a connected app, see [Uninstall a Third-Party Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_uninstall_third_party.htm&release=264.0.0&type=5 "You can uninstall a third-party connected app from your org. However, uninstalling an app doesn’t delete the connected app. Instead it removes the OAuth policies that you set for the app in your org. Because you’re removing the policies for apps that users can still access, you’re actually loosening your security measures. We recommend uninstalling a connected app only when the original developer deletes the app from their org. To make a connected app inaccessible to your org’s users, block the app. This action ends all current user sessions with the connected app and prevents all new sessions until you unblock the app.") recommendations and considerations.
6. To make the OAuth connected app inaccessible to your users, click **Block**. Blocking an app ends all current user sessions and prevents future sessions until you click **Unblock**.
7. To give users access to the connected app, click **Unblock**. By unblocking the app, users can log in and run the app.
    
    If Unblock is disabled, the app is blocked org-wide because it’s not on the allowlist. To allowlist the app, click **Install**, then click **Edit Policies**. Under the app’s OAuth settings, set Permitted Users to **Admin approved users are pre-authorized**. You can allowlist apps only if you asked Salesforce Customer Support to enable the API client allowlisting feature.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note

If the number of connected apps gets too large, it can cause timeout errors in the OAuth Usage page. This timeout error blocks new connected apps from being installed. To install a new connected app when the OAuth Usage page is experiencing timeout errors, manually create the app approval URL with the app ID and the org ID: `/identity/app/AppInstallApprovalPage.apexp?app_id=App ID&app_org_id=Org ID`

For individual users, connected apps can be installed on the user’s OAuth usage detail page.