If a webservice in Org A needs to communicate with a webservice in a package deployed in Orgs (B,C,D..) and Org A has user credentials for Orgs (B,C,D..) does the package deployed in those orgs need to have a Connected App included?

If a Connected App is not needed, what authentication flow can Org A use?

If a Connected App is needed, will Orgs (B,C,D..) all have the same consumer secret/token? Still a little fuzzy on this.


Yes i would use a Connected App for this. I also shared your confusion on this oAuth aspect for a while as well, normally things defined in one org, stay defined in that org and don't effect things outside of it.

In the case of the oAuth client Id and token this is not the case. If you define a Connected App in at least in one org, that registers that Application name on the Salesforce service such that the client Id and token are now validate to perform oAuth against any other Salesforce org. Try creating another Connected Application with the same name in another org to confirm this.

This blog Quick Tip – Using OAuth across multiple Orgs goes into some further detail in an attempt to explain this often confusing config aspect for oAuth.

You only need to setup a single Remote Access Application and you can then use the assigned ’Client Id’ and ‘Client Secret’ values to have users log into any Salesforce Org – not just the one where the Remote Access Application was setup. This question is especially relevant to ISV partners that are developing Managed Package applications are are installed by multiple customers in their respective Orgs

  • Thanks, great info and link! Still not entirely clear though. I'm confused by this line 'As an ISV developer, you only have to create a single Remote Access Application in your Developer Edition Org and include it in your Managed Package' that sounds like it will be be distributed to all orgs that have the package. If I only have to set it up in one Org to work why do I have to include it in the package? – Phil B Sep 20 '13 at 0:17
  • Actually thats a good point, I suspect this will be so that it can be proactively controlled by the Administrator, as in it will appear under the Manage Applications page after install and the admin can block access to it. It will work without packaging for sure as well, I've used it this way and not had to package it. – Andrew Fawcett Sep 20 '13 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.