Create an external client app based on one of your existing connected apps. External client apps provide many of the features of connected apps while offering increased security.
See Comparison of Connected Apps and External Client Apps Features.
Migration Availability
In Setup, go to App Manager and view your connected app. If the app meets all eligibility requirements, you see the Migrate to External Client App button. If you don't see the button, your connected app has one or more conditions that prevent migration.
Eligibility Requirements
Your connected app is eligible for migration if all of the following are true.
- User Provisioning is not enabled. Disable User Provisioning before you migrate.
- No Custom Apex Handler is configured. Remove the Connected App Handler (Apex plugin) before you migrate.
- Canvas is not enabled. You can't migrate connected apps with Canvas enabled at this time.
- Dynamic Client Registration (DCR) is not enabled. You can't migrate apps with DCR configured.
- SAML does not use Triple DES encryption. Change the SAML encryption type to AES before you migrate.
- No standard notification subscriptions are configured for non-internal apps. Only custom notification types are supported for migration.
If Your App Is Not Eligible
If you can’t migrate due to one of the prohibited conditions, create a new external client app with equivalent settings, and then update your integration to use the new external client app’s consumer credentials.
After Migration
When you migrate a connected app to an external client app, keep these details in mind.
- Migration preserves your consumer key and secret, so existing integrations continue to work.
- Refresh tokens remain valid.
- The original connected app is saved as a read-only version.
- The migrated external client app is local to your org.
Current Limitations
Keep these limitations in mind when migrating connected apps.
- You can't migrate single sign-on connected apps to external client apps. This approach causes issues with the contact center update.
- You can migrate apps only through the user interface. Use the Migrate to External Client App button in App Manager. API and CLI support isn’t available.
- Don’t delete the original connected app after migration. Both apps share the same consumer. We’ll provide safe deletion guidance in a future release.
- The migration process can’t detect username-password flow. Confirm this flow isn’t in use during migration.
- External client apps don’t support username-password flow. If you migrate a connected app that uses this flow, it won’t work on the external client app. Instead, use the OAuth 2.0 web server flow with Proof Key for Code Exchange (PKCE) or the OAuth 2.0 client credentials flow.
- Migrate a Local Connected App to an External Client App
Use the automated process to create a local external client app that replaces your existing local connected app. After migration, the old connected app remains as a read-only version in App Manager. External client apps created through migration are secure.