How to deliver a managed package with custom development?

Question

A customer wants to install our managed package on its org and needs custom development that will impacts our package core components: Somes Classes + Custom metadata types. Custom metadata types are used to store credentials for web services callout to our server. And the customer wants us to call web services to its own server (business requirements...). The question is how can we implement those changes for only that customer?

We found out few options:

1. Managed package extension: Can we use this to store customer's custom metadata types that will be used by the managed package?

2. Unmanaged package: Can we create an unmanaged package with the custom metadata types from our managed package and install it in the customer org?

3. Unlocked package: Is it possible to create an unlocked package with the custom metadata types from the managed package and install it in the customer org? What does it implies?

A 1000 thanks for your clarification!

Answer 1

The best route is likely to build your package for all customers to allow the level of customizability that you need to support this particular customer.

Apex Classs

You cannot customize Apex classes shipped in a managed package from outside the managed package, full stop. If you want to change the behavior of managed Apex, you must build some kind of control mechanism or dependency injection into your managed package.

Custom Metadata Types

This is quite case-specific. If your Custom Metadata Type is Protected, you won't be able to create records on that type from outside the managed package.

If the Type is not Protected, but you do ship Protected records of that Type, you can ship additional records of the Type in an extension managed package — but you won't be able to change or remove any Protected records in the core managed package. Whether that will suffice for your needs will depend on exactly how your package is implemented.

You can of course ship new Custom Metadata Types in an extension or unlocked package, but your existing managed package won't know anything about those Types.

Possible Routes

You could consider building your managed package as a new, Second Generation Package for this customer only, including all of the customer's desired changes. That would give you IP protection, which unlocked packages do not, while avoiding disruption to the development of your existing package.

This would of course then be a parallel line of development for the lifespan of your engagement with this customer, which implies lots of potential risks/expenses.