Agent skill

Sf Connected Apps

by Jaganpro in Jaganpro/sf-skills

Salesforce Connected Apps and OAuth configuration with 120-point scoring.

MITAuto-check: notesBackend & APIs

Install Sf Connected Apps

skills CLI
$ npx skills add Jaganpro/sf-skills --skill sf-connected-apps -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install Jaganpro/sf-skills sf-connected-apps --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/Jaganpro/sf-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/sf-connected-apps .claude/skills/sf-connected-apps && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
sf-connected-apps
GitHub stars
424
Token cost
~1.9k tokens
SKILL.md length
672 words
Files
17 (incl. references, assets)
Skills in repo
36
Repo updated
First seen
Licence
MIT

At a glance

Salesforce Connected Apps and OAuth configuration with 120-point scoring.

  • Works in 5 steps: Choose the app model → Choose the OAuth flow → Start from the right template → …
  • : user configures OAuth flows
  • SKILL.md covers When This Skill Owns the Task, First Decision: Connected App…, Required Context to Gather First and Recommended Workflow, plus 6 more sections
  • Calls sf

What it does

Sf Connected Apps is an agent skill from Jaganpro/sf-skills. Salesforce Connected Apps and OAuth configuration with 120-point scoring. TRIGGER when: user configures OAuth flows, JWT bearer auth, Connected Apps, or touches .connectedApp-meta.xml / .eca-meta.xml files. DO NOT TRIGGER when: Named Credentials for callouts (use sf-integration), permission policies (use sf-permissions), or API endpoint code (use sf-apex).

Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. The skill folder holds 18 other files, including reference files and assets (for example `CREDITS.md`, `README.md` and `references/example-usage.md`).

It sits in Backend & APIs, covering OAuth and OpenID Connect, CRM management and Authentication. It works with Salesforce. The repository describes itself as: [ARCHIVED — migrated to forcedotcom/afv-library] Salesforce Skills for Agentic Coding Tools — Apex, Flow, LWC, SOQL, Agentforce, Data Cloud, OmniStudio. Read-only archive; active… The licence is MIT.

When your agent uses it

  • : user configures OAuth flows
  • JWT bearer auth
  • Touches .connectedApp-meta.xml / .eca-meta.xml files
  • : Named Credentials for callouts (use sf-integration)

Example prompts

  • “/sf-connected-apps”

Requirements

  • Pre-approved tools (allowed-tools): Bash, Read, Write, Edit, Glob, Grep, WebFetch, AskUserQuestion, TodoWrite

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Choose the app model
  2. Choose the OAuth flow
  3. Start from the right template
  4. Apply security hardening
  5. Validate deployment readiness

What it can do on your machine

Read from SKILL.md and the folder at commit 53c9956. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash
    • Read
    • Write
    • Edit
    • Glob
    • Grep
    • WebFetch
    • AskUserQuestion
    • TodoWrite

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • sf

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sf Connected Apps loads about 1.9k tokens when it runs, and up to ~15k if it reads all its reference files. Until then it costs about 94 tokens; SKILL.md has 672 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~94
When it runs · the whole SKILL.md, loaded when a task matches
~1.9k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~15k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Bash, Read, Write, Edit, Glob, Grep, WebFetch, AskUserQuestion, TodoWrite

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Jaganpro/sf-skills at commit 53c9956, republished under its MIT licence (© Jaganpro). 672 words, ~1,901 tokens.

Download SKILL.mdSave it as .claude/skills/sf-connected-apps/SKILL.md (or your agent's skills folder). This skill also uses 16 other files; get the full folder from GitHub.
name
sf-connected-apps
description
Salesforce Connected Apps and OAuth configuration with 120-point scoring. TRIGGER when: user configures OAuth flows, JWT bearer auth, Connected Apps, or touches .connectedApp-meta.xml / .eca-meta.xml files. DO NOT TRIGGER when: Named Credentials for callouts (use sf-integration), permission policies (use sf-permissions), or API endpoint code (use sf-apex).
allowed-tools
Bash, Read, Write, Edit, Glob, Grep, WebFetch, AskUserQuestion, TodoWrite
license
MIT
metadata.version
1.1.0
metadata.author
Jag Valaiyapathy
metadata.scoring
120 points across 6 categories

sf-connected-apps: Salesforce Connected Apps & External Client Apps

Use this skill when the user needs OAuth app configuration in Salesforce: Connected Apps, External Client Apps (ECAs), JWT bearer setup, PKCE decisions, scope design, or migration from older Connected App patterns to newer ECA patterns.

When This Skill Owns the Task

Use sf-connected-apps when the work involves:

  • .connectedApp-meta.xml or .eca-meta.xml files
  • OAuth flow selection and callback / scope setup
  • JWT bearer auth, device flow, client credentials, or auth-code decisions
  • Connected App vs External Client App architecture choices
  • consumer-key / secret / certificate handling strategy

Delegate elsewhere when the user is:

  • configuring Named Credentials or runtime callouts → sf-integration
  • analyzing access / permission policy assignments → sf-permissions
  • writing Apex token-handling code → sf-apex
  • deploying metadata to orgs → sf-deploy

First Decision: Connected App or External Client App

If the need is...Prefer
simple single-org OAuth appConnected App
new development with better secret handlingExternal Client App
multi-org / packaging / stronger operational controlsExternal Client App
straightforward legacy compatibilityConnected App

Default guidance:

  • choose ECA for new regulated, packageable, or automation-heavy solutions
  • choose Connected App when simplicity and legacy compatibility matter more
  • Spring ’26 note: creation of new Connected Apps is disabled by default in orgs. For new integrations, prefer External Client Apps unless Connected App compatibility is explicitly required.

Required Context to Gather First

Ask for or infer:

  • app type: Connected App or ECA
  • OAuth flow: auth code, PKCE, JWT bearer, device, client credentials
  • client type: confidential vs public
  • callback URLs / redirect surfaces
  • required scopes
  • distribution model: local org only vs packageable / multi-org
  • whether certificates or secret rotation are required

1. Choose the app model

Decide whether a Connected App or ECA is the better long-term fit.

2. Choose the OAuth flow
Use caseDefault flow
backend web appAuthorization Code
SPA / mobile / public clientAuthorization Code + PKCE
server-to-server / CI/CDJWT Bearer
device / CLI authDevice Flow
service account style appClient Credentials (typically ECA)
3. Start from the right template

Use the provided assets instead of building from scratch:

  • assets/connected-app-basic.xml
  • assets/connected-app-oauth.xml
  • assets/connected-app-jwt.xml
  • assets/external-client-app.xml
  • assets/eca-global-oauth.xml
  • assets/eca-oauth-settings.xml
  • assets/eca-policies.xml

If you need source-controlled ECA OAuth security metadata, retrieve it from an org first and treat the retrieved file as the schema source of truth:

  • sf project retrieve start --metadata ExtlClntAppOauthSecuritySettings:<AppName> --target-org <alias>
4. Apply security hardening

Favor:

  • least-privilege scopes
  • explicit callback URLs
  • PKCE for public clients
  • certificate-based auth where appropriate
  • rotation-ready secret / key handling
  • IP restrictions when realistic and maintainable
Show full SKILL.md (273 more words)Show less
5. Validate deployment readiness

Before handoff, confirm:

  • metadata file naming is correct
  • scopes are justified
  • callback and auth model match the real client type
  • secrets are not embedded in source

High-Signal Security Rules

Avoid these anti-patterns:

Anti-patternWhy it fails
wildcard / overly broad callback URLstoken interception risk
Full scope by defaultunnecessary privilege
PKCE disabled for public clientscode interception risk
consumer secret committed to sourcecredential exposure
no rotation / cert strategy for automationbrittle long-term ops

Default fix direction:

  • narrow scopes
  • constrain callbacks
  • enable PKCE for public clients
  • keep secrets outside version control
  • use JWT certificates or controlled secret storage where appropriate

Metadata Notes That Matter

Connected App

Usually lives under:

  • force-app/main/default/connectedApps/
External Client App

Current source-supported ECA metadata uses multiple top-level source directories, not a single externalClientApps/ folder:

  • force-app/main/default/externalClientApps/ → ExternalClientApplication (.eca-meta.xml)
  • force-app/main/default/extlClntAppGlobalOauthSets/ → ExtlClntAppGlobalOauthSettings (.ecaGlblOauth-meta.xml)
  • force-app/main/default/extlClntAppOauthSettings/ → ExtlClntAppOauthSettings (.ecaOauth-meta.xml)
  • force-app/main/default/extlClntAppOauthSecuritySettings/ → ExtlClntAppOauthSecuritySettings (.ecaOauthSecurity-meta.xml)
  • force-app/main/default/extlClntAppOauthPolicies/ → ExtlClntAppOauthConfigurablePolicies (.ecaOauthPlcy-meta.xml)
  • force-app/main/default/extlClntAppPolicies/ → ExtlClntAppConfigurablePolicies (.ecaPlcy-meta.xml)

Important file-name gotchas:

  • the global OAuth suffix is .ecaGlblOauth, not .ecaGlobalOauth
  • the general policy suffix is .ecaPlcy, not .ecaPolicy
  • use .ecaOauthSecurity for ExtlClntAppOauthSecuritySettings

Output Format

When finishing, report in this order:

  1. App type chosen
  2. OAuth flow chosen
  3. Files created or updated
  4. Security decisions
  5. Next deployment / testing step

Suggested shape:

text
App: <name>
Type: Connected App | External Client App
Flow: <oauth flow>
Files: <paths>
Security: <scopes, PKCE, certs, secrets, IP policy>
Next step: <deploy, retrieve consumer key, or test auth flow>

Cross-Skill Integration

NeedDelegate toReason
Named Credential / callout runtime configsf-integrationruntime integration setup
deploy app metadatasf-deployorg validation and deployment
Apex token or refresh handlingsf-apeximplementation logic
permission review after deploymentsf-permissionsaccess governance

Reference Map

Start here
Migration / examples

Score Guide

ScoreMeaning
80+production-ready OAuth app config
54–79workable but needs hardening review
< 54block deployment until fixed

© Jaganpro, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 16 other files (references, assets) in skills/sf-connected-apps of Jaganpro/sf-skills.

  • SKILL.md
  • CREDITS.md
  • LICENSE
  • README.md
  • assets/connected-app-basic.xml
  • assets/connected-app-canvas.xml
  • assets/connected-app-jwt.xml
  • assets/connected-app-oauth.xml
  • assets/eca-global-oauth.xml
  • assets/eca-oauth-settings.xml
  • assets/eca-policies.xml
  • assets/external-client-app.xml
  • references/example-usage.md
  • references/migration-guide.md
  • references/oauth-flows-reference.md
  • references/security-checklist.md
  • references/testing-validation-guide.md

Open the folder on GitHubat commit 53c9956

Compare with similar skills

Sf Connected Apps next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Sf Connected Apps compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Sf Connected Apps this skillJaganpro/sf-skills424—~1.9kAutomated safety check: NotesMIT
Integration Connectivity Connected App Configureforcedotcom/sf-skills1.1k—~2.7kAutomated safety check: NotesApache-2.0
Frappe Core APIImpertio-Studio/Frappe_Claude_Skill_Package1871 repos~3.2kAutomated safety check: PassMIT
Soundcloud API Integrationsoundcloud/api258—~787Automated safety check: PassNone
Frappe Errors APIImpertio-Studio/Frappe_Claude_Skill_Package1871 repos~4kAutomated safety check: PassMIT
Discover APIrand/cc-polymath1811 repos~1.5kAutomated safety check: PassMIT

Similar skills

  • Salesforce Connected Apps and External Client Apps OAuth configuration with 120-point scoring.

    1.1k GitHub stars~2.7k tokensUpdated yesterday
    Backend & APIsAuto-check: notes
  • Frappe Core API

    Impertio-Studio/Frappe_Claude_Skill_Package

    A skill your agent uses when building ERPNext/Frappe API integrations (v14/v15/v16) including REST API, RPC API, authentication, webhooks, and rate limiting.

    187 GitHub starsUsed in 1 repo~3.2k tokens
    Backend & APIsAuto-check passed
  • Integrates applications with the SoundCloud HTTP API using OAuth 2.1, OpenAPI, and developer docs.

    258 GitHub stars~787 tokensUpdated 8 days ago
    Backend & APIsAuto-check passed
  • Frappe Errors API

    Impertio-Studio/Frappe_Claude_Skill_Package

    A skill your agent uses when debugging or handling API errors in Frappe/ERPNext v14/v15/v16.

    187 GitHub starsUsed in 1 repo~4k tokens
    Backend & APIsAuto-check passed
  • Discover API

    rand/cc-polymath

    Automatically discover API design skills when working with REST APIs, GraphQL schemas, API authentication, OAuth, JWT, rate limiting, API versioning, error handling, or endpoint design.

    181 GitHub starsUsed in 1 repo~1.5k tokens
    Backend & APIsAuto-check passed
  • Project Map

    gjovanovicst/golang-auth-api

    Complete module inventory of the Auth API project with file paths, dependencies, and architecture overview.

    130 GitHub stars~2.6k tokensUpdated 2 mo ago
    Backend & APIsAuto-check passed

More from Jaganpro/sf-skills

All 36 skills in this repo
  • Agentforce session tracing extraction and analysis. An agent skill from Jaganpro/sf-skills.

    424 GitHub stars~1.8k tokensUpdated 5 mo ago
    Auto-check passed
  • Sf AI Agentscript

    Jaganpro/sf-skills

    Agent Script DSL for deterministic Agentforce agents. An agent skill from Jaganpro/sf-skills.

    424 GitHub stars~3.8k tokensUpdated 5 mo ago
    Auto-check passed
  • Sf Datacloud

    Jaganpro/sf-skills

    Salesforce Data Cloud product orchestrator for connect→prepare→harmonize→segment→act workflows.

    424 GitHub stars~2.7k tokensUpdated 5 mo ago
    Auto-check passed
  • Sf Diagram Mermaid

    Jaganpro/sf-skills

    Salesforce architecture diagrams using Mermaid with ASCII fallback.

    424 GitHub stars~1.4k tokensUpdated 5 mo ago
    Auto-check passed
  • Sf Diagram Nanobananapro

    Jaganpro/sf-skills

    AI-powered image generation for Salesforce visuals via Nano Banana Pro.

    424 GitHub stars~1.6k tokensUpdated 5 mo ago
    Auto-check passed
  • Sf Flow

    Jaganpro/sf-skills

    Creates and validates Salesforce Flows with 110-point scoring.

    424 GitHub stars~1.8k tokensUpdated 5 mo ago
    Auto-check passed

Works with

Categories

Questions about Sf Connected Apps

What does Sf Connected Apps do?

Salesforce Connected Apps and OAuth configuration with 120-point scoring. Sf Connected Apps is an agent skill from Jaganpro/sf-skills. Salesforce Connected Apps and OAuth configuration with 120-point scoring.

When should I use Sf Connected Apps?

Sf Connected Apps fits situations like: : user configures OAuth flows; JWT bearer auth; touches .connectedApp-meta.xml / .eca-meta.xml files; : Named Credentials for callouts (use sf-integration).

How do I install Sf Connected Apps in Claude Code?

Run `npx skills add Jaganpro/sf-skills --skill sf-connected-apps -a claude-code`. Or copy the skill folder (skills/sf-connected-apps in Jaganpro/sf-skills) into .claude/skills/sf-connected-apps in your project. Claude Code loads it when a task matches its description.

How do I install Sf Connected Apps in Codex?

Run `npx skills add Jaganpro/sf-skills --skill sf-connected-apps -a codex`. Or copy the skill folder (skills/sf-connected-apps in Jaganpro/sf-skills) into .agents/skills/sf-connected-apps in your project. Codex loads it when a task matches its description.

Can I use Sf Connected Apps in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Jaganpro/sf-skills --skill sf-connected-apps -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sf-connected-apps, .gemini/skills/sf-connected-apps, .github/skills/sf-connected-apps and .opencode/skills/sf-connected-apps in your project.

What does Sf Connected Apps need to run?

Going by SKILL.md and its folder, Sf Connected Apps needs the command-line tools its instructions call (sf). Its frontmatter pre-approves these tools: Bash, Read, Write, Edit, Glob, Grep, WebFetch, AskUserQuestion, TodoWrite.

Does Sf Connected Apps access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Sf Connected Apps safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Sf Connected Apps use?

Sf Connected Apps is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Sf Connected Apps use?

About 1.9k tokens (SKILL.md is roughly 7.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 13k tokens, read only when the agent opens those files.

What are the alternatives to Sf Connected Apps?

Skills that share tags, products or a category with Sf Connected Apps: Integration Connectivity Connected App Configure (forcedotcom/sf-skills, 1.1k stars), Frappe Core API (Impertio-Studio/Frappe_Claude_Skill_Package, 187 stars), Soundcloud API Integration (soundcloud/api, 258 stars) and Frappe Errors API (Impertio-Studio/Frappe_Claude_Skill_Package, 187 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Sf Connected Apps?

Jaganpro (a GitHub user) maintains it in Jaganpro/sf-skills, which has 424 GitHub stars. The repository holds 36 skills in this directory. The repository was last updated on April 27, 2026.

Source: Jaganpro/sf-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.