---
schema_version: "1"
id: 378e65423685d96fa744a5ee217fda487e352ea64f79d2243c9226ea66e17f94
title: Manage Access Through a Custom Connected App Handler
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_manage_custom_handler.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_custom_handler.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5dc269324b913144c7680b979f0dfaafd13200692279cb5fe6af53f3ff19e9d6
description: Write a custom connected app handler in Apex to customize how the connected app is invoked. The custom handler can support new protocols or respond to user attributes in a way that benefits a business process.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Manage Access Through a Custom Connected App Handler

Write a custom connected app handler in Apex to customize how the connected app is invoked. The custom handler can support new protocols or respond to user attributes in a way that benefits a business process.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d83579e64">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">To read, create, update, or delete connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">To rotate the consumer key and consumer secret:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">Allow consumer key and secret rotation</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">To install and uninstall connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">To install and uninstall packaged connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83579e64 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data
                OR Manage Connected Apps</p>
            </td>
          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

1. From Setup, in the Quick Find box, enter Connected Apps, then select **Manage Connected Apps**.
2. Click **Edit** next to the connected app that you're configuring access for.
3. Under Custom Connected App Handler, enter the name of the Apex Plugin class you created to customize the behavior of the connected app.
4. For Run As, select a user account to be the execution user. The plug-in runs as the execution user on behalf of the current user of the connected app. Depending on the methods used in your `ConnectedAppPlugin` Apex class, you can sometimes leave this field blank.
    
    1. If your Apex class uses the `authorize`, `modifySAMLResponse`, or `refresh` methods, specify an execution user in the Run As field.
    2. If your class uses only the `customAttributes` method and doesn't use any other `ConnectedAppPlugin` methods, you can optionally leave the Run As field blank. The plug-in then runs as an Automated Process User, which is a system user that executes tasks behind the scenes.
    
    For more information, see the `ConnectedAppPlugin` class in the [Apex Reference Guide](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_ConnectedAppPlugin.htm#apex_class_Auth_ConnectedAppPlugin).
5. Save your settings.