5

I created a ConnectedApp in my Sandbox environment (see below img for settings details).

I noticed that I can use the consumer key and secret from my sandbox connected app to attain a PRODUCTION auth token with my PROD user/password.

Curious if you all are aware of this if there is a way to limit this functionality.

Thanks! Eric

enter image description here

Improve this question
1

1 Answer 1

Reset to default
8

This is a feature of OAuth, and is working as designed. A connected app clientId and secret can be used to connect to any org provided you go through oauth flow and enter username and password (or alternatively provide them using the username-password flow).

Note that you will still need username and password for the PROD and cannot access anything allowed by connected app scope without username and password.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .