3

I am using metadata API to retrieve connected App information. I am getting all information but NULL value for "consumerSecret" . Is there any security reason behind this?

1

2 Answers 2

6

The Client Secret is a password, and should be treated as such. You can read more about this feature in the ConnectedApp documentation:

A value that is combined with the consumerKey and used by the consumer for identification to Salesforce. Referred to as client_secret in OAuth 2.0. Typically, this value is generated by Salesforce when you create the connected app. However, the field is write-enabled so you can customize the shared secret value. Once set, the value is not returned in metadata API requests. The value must be alphanumeric (no special characters and no spaces) and a minimum of eight characters (maximum of 256 characters). If you specify a secret already in use for another connected app in the organization, you’ll get an error.

This field is available in API version 32.0 and later.

Yes, it's true that you can retrieve the Client Secret via the UI, but this feature is restricted to administrators, and only available in locally created Connected Apps (i.e. it can't be read for apps installed from a third-party).

4
  • There are several ways in which connected app can be created, if it is created by Metadata API, it doesn't return the consumer secret created and there is no way to get it... I would expect to have options to retrieve consumer secret at least when connected app is created....
    – Patlatus
    Commented Sep 20, 2022 at 18:31
  • @Patlatus Yes, it would be prudent, if creating via API, specifying a known value chosen at creation time. The field is write-enabled, so you can choose your own secret. The client secret can only be viewed in the UI for security reasons.
    – sfdcfox
    Commented Sep 20, 2022 at 18:36
  • Well, the documentation is confusing. It says "If you specify a secret already in use for another connected app in the organization, an error occurs.", which I read as "consumer secret is unique". However, I could create two connected apps with the same consumer secret, which means it is not unique. If it were unique, it might be a problem to select a unique secret.
    – Patlatus
    Commented Sep 20, 2022 at 19:00
  • @Patlatus If not unique, that's simple, just use a password you like. We can contact the docs team to see if it's a mistake. Even if it were unique, just choose 256 random letters and numbers with a program, make that your secret. With 62^256 possible combinations, you have more possible combinations than there are atoms in the observable universe.
    – sfdcfox
    Commented Sep 20, 2022 at 19:15
-2

Once consumerSecret is set, the value is not returned in metadata API requests. You can refer it in Salesforce ConnectedApp | Metadata API documentation here

consumerSecret ->

A value that is combined with the consumerKey and used by the consumer for >identification to Salesforce. Referred to as client_secret in OAuth 2.0. >Typically, this value is generated by Salesforce when you create the connected >app. However, the field is write-enabled so you can customize the shared secret >value. Once set, the value is not returned in metadata API requests. The value must be alphanumeric (no special characters and no spaces) and a >minimum of eight characters (maximum of 256 characters). If you specify a >secret already in use for another connected app in the organization, you’ll get >an error.

This field is available in API version 32.0 and later.

3
  • Please include the a summary of the relevant information from the documentation as often links break over time. See How to Answer for how to improve your answer.
    – Dave Humm
    Commented Oct 16, 2018 at 8:52
  • @DaveHumm , Vigneshwaran G Thanks for feedback. I have updated my comment. Commented Oct 16, 2018 at 10:28
  • 1
    how is that different from what sfdcfox said?
    – kurunve
    Commented Oct 16, 2018 at 10:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .