---
schema_version: "1"
id: 81a8cf48eec5f4e31ba84b30629e536aad1b76e8cd9a560695af3a13fd304b75
title: Comparison of Connected Apps and External Client Apps Features
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_apps_and_external_client_apps_features.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_apps_and_external_client_apps_features.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: cbc9c70775db2f87e2848b89c618198f4c5d6385eae1a2e5812af4a1726dc42f
description: Connected apps offer a framework to provide external applications with your Salesforce data. However, there are aspects of the framework that make it impossible to define separate user roles and difficult to package connected apps. External client apps were designed to be as useful at connecting external applications with your data as connected apps while addressing these shortcomings.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Comparison of Connected Apps and External Client Apps Features

Connected apps offer a framework to provide external applications with your Salesforce data. However, there are aspects of the framework that make it impossible to define separate user roles and difficult to package connected apps. External client apps were designed to be as useful at connecting external applications with your data as connected apps while addressing these shortcomings.

External client apps are the new generation of connected apps. They were designed to improve security and resolve the cumbersome packaging and distribution issues that affect connected apps. External client apps maintain a clean separation between proprietary developer settings and the customizable, admin-defined policies. External client apps support all but a few of the connected apps use cases.

Use this table of available features to figure out whether external client apps are the best option to integrate your external application with Salesforce.

  
| Feature | Connected Apps | External Client Apps |
| --- | --- | --- |
| 2GP Packaging | [Restricted](https://developer.salesforce.com/docs/atlas.en-us.pkg2_dev.meta/pkg2_dev/sfdx_dev_dev2gp_connected_app.htm) (1) | [Available](https://help.salesforce.com/s/articleView?id=xcloud.configure_packageable_external_client_apps.htm&release=264.0.0&type=5 "Determine whether to package and distribute your external client app or keep it local. Only packaged apps can be deployed to other orgs. You can package external client apps with first-generation or second-generation managed packages. Apps that use OAuth can be deployed with their own OAuth settings or they can reference settings on the org where the app was developed.") |
| 1GP Packaging | [Available](https://developer.salesforce.com/docs/atlas.en-us.pkg1_dev.meta/pkg1_dev/connected_apps.htm) | [Available](https://help.salesforce.com/s/articleView?id=xcloud.package_external_client_app_with_1gp.htm&release=264.0.0&type=5 "Use first-generation managed packages to distribute external client apps to other orgs. Create an external client app with Packaged distribution state, add it to your managed package, and install the package in subscriber orgs.") |
| Distribution state management | Not available | [Available](https://help.salesforce.com/s/articleView?id=xcloud.configure_packageable_external_client_apps.htm&release=264.0.0&type=5 "Determine whether to package and distribute your external client app or keep it local. Only packaged apps can be deployed to other orgs. You can package external client apps with first-generation or second-generation managed packages. Apps that use OAuth can be deployed with their own OAuth settings or they can reference settings on the org where the app was developed.") |
| Distinct developer and admin user roles | Not available | [Available](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&release=264.0.0&type=5 "External client apps are packageable frameworks to enable a third-party application to integrate with Salesforce using APIs and security protocols. External client apps provide single sign-on (SSO) and use SAML and OAuth protocols to authorize third-party applications. Third-party applications that are integrated with Salesforce can run on the customer success platform as well as other platforms, devices, or SaaS subscriptions.") |
| Subscriber association and disassociation | Not available | [Available](https://help.salesforce.com/s/articleView?id=xcloud.associate_and_disassociate_external_client_apps.htm&release=264.0.0&type=5 "External client apps are designed for second-generation (2GP) packaging, which means that they’re optimized for source-driven development on scratch orgs.") |
| Salesforce Setup UI | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_basics.htm&release=264.0.0&type=5 "For all connected apps, define the basics, which include the app’s name, logo, and contact information.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&release=264.0.0&type=5 "Create an external client app in App Manager. Local external client apps are available only on the org where you create them. Packageable external client apps can be packaged for distribution to other orgs.") |
| Metadata API | [Restricted](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_connectedapp.htm) (2) | [Available](https://help.salesforce.com/s/articleView?id=xcloud.meta_external_client_apps_creation.htm&release=264.0.0&type=5 "Developers can create external client apps in Salesforce Setup or programmatically using Metadata API. After downloading an external client app, admins can configure Policies specific to the needs of their org.") |
| OAuth 2.0 | [Available](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_authenticate.htm&release=264.0.0&type=5 "OAuth is an open protocol that authorizes a client application to access data from a protected resource through the exchange of tokens. OAuth tokens are essentially permissions given to a client application.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps_oauth_flow_config.htm&release=264.0.0&type=5 "External Client Apps support several OAuth flows. These flows allow the third-party application to access protected resources on Salesforce.") (3) |
| SAML | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_saml_sso.htm&release=264.0.0&type=5 "To integrate a service provider with your Salesforce org, you can use a connected app that implements SAML 2.0 for user authentication. Salesforce supports SAML single sign-on (SSO) when the service provider or the identity provider initiates the flow. To use this option, configure a connected app with SAML 2.0 enabled for your service provider. Define your Salesforce org as the SAML identity provider.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_saml.htm&release=264.0.0&type=5 "To integrate a service provider with your Salesforce org, you can use an external client app that implements SAML 2.0 for user authentication. Salesforce supports SAML single sign-on (SSO) when the service provider or the identity provider initiates the flow. To use this option, configure an external client app with SAML 2.0 enabled for your service provider. Define your Salesforce org as the SAML identity provider.") |
| OpenID Connect | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_openid_connect.htm&type=5&language=en_US) | Available |
| OAuth consumer key and consumer secret rotation | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_rotate_consumer_details.htm&release=264.0.0&type=5 "Keep your connected apps secure by periodically changing your consumer key (client ID) and consumer secret (client secret). To make sure that your existing integrations don’t break, generate staged consumer details and share them with your connected app integrations. When you're ready, apply the new consumer details.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.eca_stage_oauth_credentials.htm&release=264.0.0&type=5 "Use the OAuth Staged Credentials Connect REST API endpoint to manage the OAuth key and secret for a local external client app. The API can be used to stage, view, rotate, or delete OAuth credentials.") |
| Trusted IP Range for OAuth Web Server Flow | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_edit_ip_ranges.htm&release=264.0.0&type=5 "After you create a connected app, you can specify the trusted IP ranges from which a user can log in. In addition, you can apply IP relaxation to all OAuth client apps, including apps that use OAuth and SAML for single sign-on.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_external_client_app_oauth_settings.htm&release=264.0.0&type=5 "Configure the OAuth settings file, which affects the local instance.") |
| Copy when cloning a sandbox | Available | [Available](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&release=264.0.0&type=5 "External client apps are packageable frameworks to enable a third-party application to integrate with Salesforce using APIs and security protocols. External client apps provide single sign-on (SSO) and use SAML and OAuth protocols to authorize third-party applications. Third-party applications that are integrated with Salesforce can run on the customer success platform as well as other platforms, devices, or SaaS subscriptions.") (4) |
| API access control | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage.htm&release=264.0.0&type=5 "After a connected app is installed in your org, you can manage access to it. Configure permissions and policies for the app, explicitly defining who can use the connected app and where they can access the app from. These permissions and policies, which include user-access, IP range restrictions, and multi-factor authentication (MFA), provide extra security for your org.") | Not needed (5) |
| Custom attribute creation | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_edit_custom_attributes.htm&release=264.0.0&type=5 "After you’ve created the connected app, you can add custom attributes. With custom attributes, you can get more information about a user’s identity like an address or job title. Custom attributes specify SAML metadata or specify OAuth parameters that are read at OAuth runtime.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.configure_custom_attributes_for_external_client_apps.htm&release=264.0.0&type=5 "Create custom attributes to capture useful and unique information. With custom attributes, you can get more information about a user’s identity such as an address or job title. Configure custom attributes for your external client app in the Policies tab.") |
| Audit support | [Available](https://help.salesforce.com/s/articleView?id=xcloud.admin_monitorsetup.htm&type=5&language=en_US) | [Available](https://help.salesforce.com/s/articleView?id=xcloud.admin_monitorsetup.htm&type=5&language=en_US) |
| Logging support | [Available](https://help.salesforce.com/s/articleView?id=xcloud.admin_monitorsetup.htm&type=5&language=en_US) | [Available](https://help.salesforce.com/s/articleView?id=xcloud.admin_monitorsetup.htm&type=5&language=en_US) |
| Start URL management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_start_url.htm&release=264.0.0&type=5 "A start URL defines the page where users are directed to when they run the connected app. The start URL can be configured by the app owner during the setup process or managed later. If you don’t configure a start URL, users are sent to the app’s default start page after authorization completes. Start URL settings apply to all connected apps, except canvas apps. If your app is a canvas app, the connected app ignores the start URL fields. Instead, it uses the canvas app URL specified when the connected app was created.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.manage_eca_start_url.htm&release=264.0.0&type=5 "A start URL defines the page where users end up when they run an external client app. The admin of an external client app sets an OAuth-specific start URL or a custom start URL from the Policies tab of the External Client App Manager.") |
| OAuth access policy management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&release=264.0.0&type=5 "Configure OAuth access policies for OAuth-enabled connected apps. These policies include defining which users can access a connected app, what IP restrictions apply to the connected app, and how long a refresh token is valid for.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.manage_external_client_apps.htm&release=264.0.0&type=5 "After creating an external client app and configuring its distribution state, define its specific characteristics.") |
| IP relaxation | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_continuous_ip.htm&release=264.0.0&type=5 "For security reasons, if you relax IP restrictions for your connected app, and your org has enabled Enforce login IP ranges on every request, users can’t access the app in some circumstances. This access restriction applies to all OAuth-enabled connected apps, including mobile devices.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.manage_external_client_apps.htm&release=264.0.0&type=5 "After creating an external client app and configuring its distribution state, define its specific characteristics.") |
| Session policy management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&release=264.0.0&type=5 "Configure a connected app’s session policies to define how long a user’s session can last before reauthenticating. You can also use session policies to block user access to the connected app, or to require two-factor authentication to access the app.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.manage_external_client_apps.htm&release=264.0.0&type=5 "After creating an external client app and configuring its distribution state, define its specific characteristics.") |
| Mobile policy management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_mobile.htm&release=264.0.0&type=5 "Configure policies for mobile connected apps that enforce PIN protection. These policies include setting the length of the connected app’s PIN, and defining how long a session can be idle before requiring re-entry of the PIN.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_mobile_settings_policies.htm&release=264.0.0&type=5 "The mobile app plugin for an external client app enables mobile-specific features, such as screen lock upon a custom timeout value. Configure the external client app’s mobile app settings and policies in External Client App Manager.") |
| Custom handler management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_custom_handler.htm&release=264.0.0&type=5 "Write a custom connected app handler in Apex to customize how the connected app is invoked. The custom handler can support new protocols or respond to user attributes in a way that benefits a business process.") | [Available](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_ExternalClientAppOauthHandler.htm) |
| User provisioning | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning.htm&release=264.0.0&type=5 "You can use a connected app to link your users with a third-party app. User provisioning for a connected app simplifies account creation and links your Salesforce users’ accounts to their third-party accounts. After the accounts are linked, you can configure the App Launcher to display the connected app as a tile. With a single click, users get instant access to the third-party app.") | Not available |
| OAuth usage management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_current_sessions.htm&release=264.0.0&type=5 "The Connected Apps OAuth Usage page displays current OAuth app connections. For apps that aren't installed, it also displays usage attempts that Salesforce automatically denied due to security restrictions. From this page, you can install or uninstall third-party connected apps, revoke an app’s active sessions, and block or unblock org-wide access to the app.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.manage_external_client_app_usage.htm&release=264.0.0&type=5 "The External Client Apps OAuth Usage page displays information about external client apps for the current org, all users for a specific external client app, and all tokens for a specific user. These apps have an active access or refresh token. From this page, you can revoke a specific token, all tokens for a user of a specific external client app, or all tokens of a specific external client app.") |
| Profile management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_additional_settings.htm&release=264.0.0&type=5 "The Connected App Detail page provides an overview of access settings assigned to the connected app, including OAuth policies and session policies. From this page, you can click Edit Policies to manage access to the connected app. You can also manage profiles, permission sets, custom attributes, and custom scopes associated with the connected app.") | [Available](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&language=en_US) |
| Permission set management | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_additional_settings.htm&release=264.0.0&type=5 "The Connected App Detail page provides an overview of access settings assigned to the connected app, including OAuth policies and session policies. From this page, you can click Edit Policies to manage access to the connected app. You can also manage profiles, permission sets, custom attributes, and custom scopes associated with the connected app.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.manage_external_client_apps.htm&release=264.0.0&type=5 "After creating an external client app and configuring its distribution state, define its specific characteristics.") |
| Data access management (OAuth) | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage.htm&release=264.0.0&type=5 "After a connected app is installed in your org, you can manage access to it. Configure permissions and policies for the app, explicitly defining who can use the connected app and where they can access the app from. These permissions and policies, which include user-access, IP range restrictions, and multi-factor authentication (MFA), provide extra security for your org.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_external_client_app_policies.htm&release=264.0.0&type=5 "Salesforce admins can set the policies that control the external client app. All changes are made through the metadata API.") |
| Canvas | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_canvas.htm&release=264.0.0&type=5 "You can expose your connected app as a canvas app. Canvas apps are available as apps that your org’s Salesforce admin install or as personal apps that users install across orgs. Users access a canvas personal app from the Chatter tab, and are prompted to allow the app to connect to their Salesforce data. Users can choose to make an app a canvas personal app.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_canvas.htm&release=264.0.0&type=5 "The Canvas plugin for an external client app enables you to integrate a third-party application in Salesforce. Configure the external client app’s Canvas app settings and policies in External Client App Manager.") |
| Notifications | [Available](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_notifications.htm&release=264.0.0&type=5 "Keep users of your custom app up to date with timely information and reminders. With the connected app framework, you can use the Notification Builder Platform or Apex Push to send custom notifications.") | [Available](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_notification_settings.htm&release=264.0.0&type=5 "With the notifications plugin for an external client app, you can subscribe the mobile app to custom notification types. Enable the notifications plugin, and subscribe the mobile app to notification types in External Client App Manager.") |

1\. Packaging and distribution are some of the major issues facing connected apps. This challenge was a driving force in the development of external client apps. Connected apps use a reference model for packaging. They can’t be packaged using second-generation (2GP) managed packaging. However, there’s a work-around [method that includes packaging connected apps](https://developer.salesforce.com/docs/atlas.en-us.pkg2_dev.meta/pkg2_dev/sfdx_dev_dev2gp_connected_app.htm) in a first generation (1GP) managed package and referencing that packaged connected app in a 2GP managed package. External client apps were designed with 2GP packaging in mind and feature advanced options for packaging and distribution. External client apps can also be added to 1GP managed packages.

2\. Connected apps can access a subset of features through the [ConnectedApp endpoint in the Metadata API](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_connectedapp.htm).

3\. External client apps use OAuth protocols to authorize third-party apps. However, there are some OAuth features that are available for connected apps but aren’t available for external client apps. For example, [the OAuth username-password flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&language=en_US) won't be made available for external client apps. Also, dynamic client registration is not yet supported for external client apps.

4\. Local external client apps aren’t copied to a new sandbox when you clone or refresh a sandbox. Only packaged external client apps are copied to the sandbox.

5\. External client apps can’t be used without installation, so access control isn't necessary.