Salesforce Platform: New Connected Apps Can No Longer Be Created in Spring '26

Summary

External client apps (ECAs) connect applications with Salesforce data while maintaining security and clearly defined user roles. ECAs offer security and use second-generation managed packaging.

To continue the rollout of ECAs and move toward long-term end of support (EOS) for connected apps, we are disabling the ability to create connected apps by customers. New connected apps will be allowed by package installation, and customers can continue creating connected apps if they make a request to Salesforce Support.

Existing connected apps will continue to work and can be installed in new orgs via package installation. Connected app editing, installation (by packaging or OAuth install), and deletion will not be affected by this change. All existing connected apps will continue to work.

Note: Connected App creation via APIs (including the Metadata API) is blocked in the same way as the UI.

What is changing?

In the Spring ‘26 release, as part of the ECA rollout, connected app creation through UI was disabled by default on all new orgs. Customers were required to turn on the Allow creation of connected apps setting to continue creating connected apps through UI.

Starting in the Spring ‘26 release, customers won’t be able to turn on this behavior unless they request the ability to create connected apps from Salesforce Support. Connected app creation will be prevented through both API and UI, with the exception of package installation.

Why are we doing this?

External client apps are the new generation of connected apps. They were designed to improve security and resolve the cumbersome packaging and distribution issues that affect connected apps.

What do I need to do?

Stay Aware

Any time an application is connected to Salesforce, the application and a third party can access your data. Only click “Allow” if you trust the application and the third party. If you are contacted and asked to install any applications via phone or email, do not proceed and report it to -
1) Your organization's administrator
2) Your security team, and
3) The Salesforce security team at security.salesforce.com/contact.

Prepare

Start preparing for the End of Support for connected apps by inventorying your connected apps, and start using ECAs instead.

If you need to continue using existing connected apps, you can do so. However, no new connected apps can be created with the Spring ‘26 release unless enabled by Salesforce Support. In future releases, Salesforce Support won’t be able to enable the creation of new connected apps.

To migrate your existing connected apps to external client apps, see Connected App to External Client App Migration.

FAQ

1. Timelines, Deadlines, and End-of-Support (EOS)

When is the cutoff for new Connected Apps?

Starting in the Spring ’26 release, the ability to create new legacy Connected Apps will be disabled.

What is the roadmap for existing Connected Apps (CAs)?

With this Spring ‘26 release, Salesforce disables the creation of new Connected Apps by default. Existing Connected Apps will continue to function.

Salesforce will be announcing End-of-Support (EOS) for existing Connected Apps soon. What is End-of-Support (EOS)?

With EOS, existing Connected Apps continue to function but Salesforce no longer provides bug fixes, security updates, or technical support. It's highly recommended to migrate to External Client Apps (ECAs) before End-of-Support.

Does "End of Support" (EOS) mean my apps will stop working?

Currently, existing Connected Apps will continue to function and they are not yet at “End of Support”. However, the future "End of Support" means Salesforce will no longer provide bug fixes, security updates, or technical assistance for the legacy framework. We strongly recommend migrating to the ECA framework now to prepare for the future EOS to ensure business continuity.

When will Salesforce-owned apps (for example Workbench and Salesforce for iOS) migrate to ECAs?

Salesforce is currently working on internal migration paths for Salesforce owned Connected Apps. Updates for these specific apps will be released according to the standard Salesforce release cycle.

2. Migration Logistics: Tools and Process

Is there an official migration tool?

Yes. Salesforce is providing a local CA to ECA Migration Tool. It is designed to assist in converting legacy metadata into the new ECA metadata format. See the KA Create an External Client App from a Connected App.

Is the migration manual or automated?

After opting in manually, the local Connected App migration is automated.

How do I handle Connected Apps created via Apex?

For apps created or managed through Apex code, you will need to refactor your logic to interact with the External Client App metadata objects. Developers should consult the External Client Apps Developer Guide for specific object and field mappings.

3. Impact on Existing Apps and Integrations

What happens to Managed Packages provided by a third party (e.g. AppExchange app) ?

While existing Connected Apps and Connected Apps installed as part of a managed package remain unaffected by the changes after Spring ‘26 release, we encourage app providers to begin using External Client Apps so that they can be prepared for the future changes impacting existing Connected Apps like End-of-Support and retirement.

If a Connected App is part of a managed package, it is the ISV's (the vendor's) responsibility to provide a migrated ECA version of their app. Customers must wait for the vendor to release an updated package version before they can migrate that specific integration.

Will third-party integrations stop working in Spring '26?

No. Existing connections will continue to work. The Spring '26 restriction only prevents the creation of new apps. However, if you need to create a new integration after that date, it must be an ECA.

4. Technical and Security Implications

Will users need to re-authenticate after doing the local CA to ECA migration?

Users will not need to re-authenticate, all the existing integrations will continue to work.

5. Sandboxes, Deployment, and Permissions

How do sandbox refreshes affect ECAs?

Local ECAs cannot be refreshed. Local external client apps aren’t copied to a new sandbox when you clone or refresh a sandbox. Only packaged external client apps are copied to the sandbox.

Do CI/CD users need new permissions?

Yes. To deploy ECA metadata via SFDX or the Metadata API, your deployment user or service principal must be granted the Manage External Client Apps permission.

Can I track ECA usage?

Yes. ECAs will be visible in Setup under External Client Apps or under the OAuth Usage page in Setup, allowing admins to monitor active sessions and security logs just as they did with legacy Connected Apps via the Connected Apps OAuth Usage page in setup.

Next Steps:

Review these articles for more information
Reach out to your third-party AppExchange vendors to request their ECA migration roadmap.

NOTE: This document is for informational purposes only, and is not part of any legal or otherwise binding agreement. The policies and practices described in this document are subject to change at Salesforce's sole discretion. All dates are subject to change.