---
schema_version: "1"
id: 53412511a29675ab52a43d137950d63755bb6e8630ebe3d9c96c999e66f6b80f
title: Connected App to External Client App Migration
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_to_external_client_app_migration.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_to_external_client_app_migration.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ad2bd177a49a800cad7383ff5f8461fce7072735f5061091fda1eee75f64bb7d
description: Create an external client app based on one of your existing connected apps. External client apps provide many of the features of connected apps while offering increased security.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Connected App to External Client App Migration

Create an external client app based on one of your existing connected apps. External client apps provide many of the features of connected apps while offering increased security.

See [Comparison of Connected Apps and External Client Apps Features](https://help.salesforce.com/s/articleView?id=xcloud.connected_apps_and_external_client_apps_features.htm&release=264.0.0&type=5 "Connected apps offer a framework to provide external applications with your Salesforce data. However, there are aspects of the framework that make it impossible to define separate user roles and difficult to package connected apps. External client apps were designed to be as useful at connecting external applications with your data as connected apps while addressing these shortcomings.").

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_tip.png)

Tip Setup with Agentforce can help you migrate connected apps more efficiently. For more information, see [Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_overview.htm&language=en_US) and [Identity Management in Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_identity.htm&language=en_US).

## Migration Availability

In Setup, go to App Manager and view your connected app. If the app meets all eligibility requirements, you see the **Migrate to External Client App** button. If you don't see the button, your connected app has one or more conditions that prevent migration.

## Eligibility Requirements

Your connected app is eligible for migration if all of the following are true.

- User Provisioning is not enabled. Disable User Provisioning before you migrate.
- No Custom Apex Handler is configured. Remove the Connected App Handler (Apex plugin) before you migrate.
- Canvas is not enabled. You can't migrate connected apps with Canvas enabled at this time.
- Dynamic Client Registration (DCR) is not enabled. You can't migrate apps with DCR configured.
- SAML does not use Triple DES encryption. Change the SAML encryption type to AES before you migrate.
- No standard notification subscriptions are configured for non-internal apps. Only custom notification types are supported for migration.

## If Your App Is Not Eligible

If you can’t migrate due to one of the prohibited conditions, create a new external client app with equivalent settings, and then update your integration to use the new external client app’s consumer credentials.

## After Migration

When you migrate a connected app to an external client app, keep these details in mind.

- Migration preserves your consumer key and secret, so existing integrations continue to work.
- Refresh tokens remain valid.
- The original connected app is saved as a read-only version.
- The migrated external client app is local to your org.

## Current Limitations

Keep these limitations in mind when migrating connected apps.

- You can't migrate single sign-on connected apps to external client apps. This approach causes issues with the contact center update.
- You can migrate apps only through the user interface. Use the **Migrate to External Client App** button in App Manager. API and CLI support isn’t available.
- Don’t delete the original connected app after migration. Both apps share the same consumer. We’ll provide safe deletion guidance in a future release.
- The migration process can’t detect username-password flow. Confirm this flow isn’t in use during migration.
- External client apps don’t support username-password flow. If you migrate a connected app that uses this flow, it won’t work on the external client app. Instead, use the OAuth 2.0 web server flow with Proof Key for Code Exchange (PKCE) or the OAuth 2.0 client credentials flow.

- **[Migrate a Local Connected App to an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.migrate_connected_app_to_external_client_app.htm&release=264.0.0&type=5)**  
    Use the automated process to create a local external client app that replaces your existing local connected app. After migration, the old connected app remains as a read-only version in App Manager. External client apps created through migration are secure.