I wonder about the Salesforce orgs connection happening between 2 salesforce environments.

The general norm:

  1. Create a connected app in the target org and generate the consumer key and consumer secret key.
  2. Provide these keys in the source org auth. provider.
  3. Use the above auth. provider in the named credential.

The unexpected one: In our present organization, the connection between the two orgs is done using:

  1. Create a auth. provider and copy the consumer key and consumer secret from the connected app in the same org into the auth. provider.
  2. On click of save on Named credentials, the save is being successful even though I give the credentials of the other scratch org to which the consumer key and consumer secret does not belong to.

How is this really happening? Is this expected?

  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Jan 6, 2023 at 6:52

1 Answer 1


Connected Apps have two features: authorization and authentication. Authentication seems easy enough: you use your username, password, 2FA/MFA, whatever, and you log in to the user you wish to connect. Next, the user will be requested to authorize some permissions, called the "scope", which may limit the app's ability to access less than the user's full range of data.

If you've read about Connected Apps, you may have noticed that the Client Secret should be treated as a password, and changed if compromised. This is because, if I know your Client Id and Client Secret, I can build an app that impersonates your app. Of course, for something like Salesforce-2-Salesforce, the risk is relatively minimal, but you should be aware of that feature.

The org that you're logging into does not need to be the Connected App that holds the Consumer Secret. The org you're already trying to connect to also doesn't need to have the Consumer Secret. The Connected App in no way limits which orgs you can log in to as long as you have the Id and Secret. There are some limits to active sessions, such as 5 active sessions per Consumer Key per User, which is why you're supposed to follow the rules. However, if you mess up, it's probably not a big deal. You can also just go back and fix it now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .