I created a Connected App in a dev environment and now I need to duplicate it in a test environment. Can this be done via a changeset, VS Code, or does it need to be done manually?



A brief search through the metadata categories made available to us when we add items to a changeset is enough to say that Connected Apps cannot be deployed via a changeset.

We can use the Salesforce CLI to retrieve and deploy connected apps1 (and you could also use the legacy Ant migration tool with package.xml), but be aware that a sandbox refresh (dev, partial, or full) will also copy your connected apps from your production org (that is if you're refreshing from a production org, not sure about sandbox-sandbox refreshes).

One gotcha with copied/deployed connected apps is that they'll have a different consumer key and consumer secret. That may not be an issue for you, but in my case it was a consideration that needed to be taken into account (it meant I needed to involve another development team whenever I'd refresh my sandbox, since they'd need to update their sandbox to use my new sandbox consumer key).

The approach I suggest

I'd propose an alternative approach. Keep your connected app defined and managed in a long-lived/permanent org (like a production org), and then "install" it in sandboxes as needed.

You can do that by simply going through the user-agent OAuth flow. In other words, fill in the appropriate data in the following URL, then copy and paste it into your browser

https://test.salesforce.com/services/oauth2/authorize?client_id=<your consumer key>&redirect_uri=<url-encoded callback url for your connected app>&response_type=token

If you need to install an app from a sandbox into production (not recommended), then test.salesforce.com should be changed to login.salesforce.com.

When I need to do this I'll usually get some error message, but the connected app is added to my sandbox. I'll then need to go to the "Connected Apps OAuth Usage" page and click the "Install" button.

From there, I can manage app policies (set up pre-authorized profiles) and then my JWT auth requests will start going through successfully.

1: Consumer keys are globally unique, and Salesforce will not allow you to deploy a connected app if the xml contains the <consumerKey> tag. Removing that tag allows the deployment, and will end up generating a new consumer key.

Not the answer you're looking for? Browse other questions tagged or ask your own question.