18

I have been trying to fiddle with OAuth user-agent flow and understand that you need to have a connected app defined in Salesforce. You would then use the client secret from that in your app to be able to start the OAuth dance.

How come workbench.developerforce.com is able to do this without us creating any connected app in any Salesforce org? Does this web app have some special privileges with Salesforce that it gets the client secret from any Salesforce org?

|improve this question
6

Connected apps only need to be defined one total, not once per org. You can use any org, like a free developer org, to set up the oAuth/connected app info, and then use that with as many consumer orgs as you want.

|improve this answer
  • 1
    But how is it secure? If I have a web app and I create a connected app in my client's production org, will I be able to use the same client_id to connect to another client's production org from my web app? – prashanthkr Jan 29 '14 at 22:22
  • Yes. You'll still need the user to consent to allowing access to your app, and in the event your app does something malicious salesforce can revoke your client id across all orgs. – ca_peterson Jan 29 '14 at 22:59
3

It's kind of old post but i felt very motivated to provide some more information regarding Workbench here.

The first thing is you can actually package the connected apps so that you don't need to create them every time on every org. You just need to install them there.

In case of workbench actually Salesforce installs a package through automated process. For more information about this package you can see my answer in this thread

This package is generally pre installed or get installed when you access workbench first time.

Workbench connected app

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.