Skip to main content
31 votes
Accepted

Extension packages & Licence Management in 2GP

Thanks for the question! I've created an answer in three parts, each one meant to address a specific question you've asked. PART ONE: How to Create Second-Generation Extension Packages PART TWO: How ...
Vivek M. Chawla's user avatar
19 votes
Accepted

Custom Metadata vs. Custom Objects in Managed Package

Here are some "advantages" vs using a Custom Object: Can be Deployed Can use Field Definition or Entity Particle to create references to Custom Object Metadata Retrieve doesn't cost against ...
NSjonas's user avatar
  • 10.2k
19 votes

Modularize (existing) LWC for reuse and flexible distribution

This is a complex topic and I’m going to do my best to give some quick pointers but we could fill an entire white paper on this theme and I’m sure that are some things that I might overlook. Inter-...
POZ's user avatar
  • 4,419
17 votes
Accepted

Should DX Unlocked packages be used for app distribution to customers

TLDR: No, Unlocked Packages cannot be used like this. Anyone commercially distributing a Salesforce app must do so using Managed Packages. Also, Managed Packages offer many valuable features simply ...
Vivek M. Chawla's user avatar
16 votes

Custom Metadata vs. Custom Objects in Managed Package

A reason I haven't seen articulated yet applies specifically to the managed package context: Packaged, protected Custom Metadata Types are an ideal solution for secret storage in a managed package ...
David Reed's user avatar
  • 93.2k
16 votes
Accepted

Best practices for breaking 1 GP monoliths into 2GP modules

This is a great topic. Many Salesforce Partners are exploring ways they can leverage 2GP today, even as they wait for 1GP=>2GP migration which is currently available only as a developer preview (...
Vivek M. Chawla's user avatar
13 votes
Accepted

How to make a LWC component that's usable on all object record pages?

In this case, targetConfigs is an optional tag. it is upon you, weather you want to restrict the component to be used on some particular object record page. If you don't want, simply remove the below ...
sanket kumar's user avatar
  • 15.4k
13 votes
Accepted

Do 2GP Managed Packages send email notifications on unhandled Apex errors?

Yes, unhandled exception emails do work with 2GP. I confirmed this by creating a managed 2GP with a Visualforce Controller that tries to divide by zero if a certain custom metadata record is set to ...
Vivek M. Chawla's user avatar
12 votes
Accepted

Get currently installed package version from Apex Class

You can use System.requestVersion, which returns the version of your package. See Version for more details, but I'll also include the snippet from there here: if (System.requestVersion() == new ...
sfdcfox's user avatar
  • 497k
12 votes
Accepted

Friction-free process to switch to SalesforceDX with existing managed package

Summary The next generation of packaging is still very much a work in progress. The core focus is embracing the source control driven approach of DX into how we develop and distribute packages. The ...
BritishBoyinDC's user avatar
12 votes
Accepted

How to OWASP ZAP scan external REST API using OAuth2

For Finding vulnerabilities in the API only application(does not have a web app and you have access to only its REST API), you can configure proxies in the Postman and execute OAuth and other REST api ...
Mohith Shrivastava's user avatar
11 votes

How do I publish apps on AppExchange for free as a freelancer?

You should be able to sign up for a partner community using your dev org login credentials where you have built the package . https://partnersignup.salesforce.com/partnerLogin You will get access to ...
Mohith Shrivastava's user avatar
11 votes
Accepted

Who has taken "my" Managed package namespace? Can we find out?

There is the possibility of installing the package using Metadata API. Then inspect the company details, package version description or documentation (etc) for meaningful contact information. For ...
Matt and Neil's user avatar
11 votes

Handle chain of long-running callouts from Salesforce

Roughly speaking, this is what Queueables are for. Once Transaction Finalizers are GA, I think they'll be a pretty good solution for this. There are many concerns, though: The Queues If you're ...
Aidan's user avatar
  • 13.7k
9 votes
Accepted

Upload unmanaged package on AppExchange, without being Salesforce ISV Partner?

You can join the partner program as an individual ISV partner and list free apps on the app exchange (managed or unmanaged) at no cost (I've done so!). However, you'll need to be fairly persistent ...
Christian Carter's user avatar
9 votes
Accepted

Not being able to reference packaged custom LWCs from other LWCs outside the package

Cross namespace import and communication is currently restricted because of a security limitation in LWC. With our current Lightning Locker architecture there just isn’t a secure way to enable it. ...
Kiril Seksenov's user avatar
9 votes

Call Salesforce API from Apex and not fail Security Review

The OAuth flow we used for our AppExchange app is Web Server Flow for Web App Integration. There are various types of flows that can be used as per your requirements; we used Web Server Flow for Web ...
Chirag Mehta's user avatar
  • 1,261
8 votes
Accepted

When to set Lightning access=GLOBAL in Managed Packages

Let's consider the following base scenario to answer your questions: you plan to use a contrib:parentComp component. contrib:parentComp has a child component contrib:childComp. contrib:childComp has ...
POZ's user avatar
  • 4,419
8 votes
Accepted

Manipulate (packaged) Flow using Apex

Salesforce has exposed tooling api that can help you clone the Managed Package flow if it is packaged as template. Note you can wrap this tooling api via an apex class and achieve everything that API ...
Mohith Shrivastava's user avatar
8 votes

Can we prove security using Apex Tests & System.runAs()?

I must admit, we have not attempted to revisit this side of things - our core managed package is too large and too mature. What I do know, from the few uses of System.runAs we have, is that this is ...
Phil W's user avatar
  • 37k
8 votes
Accepted

Evolve global classes in 1GP Managed packages (e.g. add method)

You cannot add a new abstract method to a published global class since this would invalidate any existing implementations/extensions of that class; they would be incomplete. You can, however, add new ...
Phil W's user avatar
  • 37k
7 votes

Upload unmanaged package on AppExchange, without being Salesforce ISV Partner?

You can upload and distribute unmanaged (and even managed) packages, but you won't be able to list it "publicly." Users can still install it if they can get a link to it, for example, from your ...
sfdcfox's user avatar
  • 497k
7 votes

When and where should a connected app be created during DX managed package development?

I found the following in the Special Behavior in Metadata API Deployments: Connected App You cannot set the consumerKey in Metadata API. It is included in a retrieve operation for informational ...
Daniel Ballinger's user avatar
7 votes
Accepted

Platform Cache for ISVs

Probably a good question for Partner Success. But I know myself and other ISVs I talked to were put off by the cost - it was pretty expensive to buy cache dedicated to my namespace since it was a per ...
BritishBoyinDC's user avatar
7 votes
Accepted

How to test CRUD and FLS in unit tests?

There are a few different ways to attack this problem, but the most common is to create a user with permissions, and then use System.runAs to execute your tests. I normally grant permissions to my ...
Sebastian Kessel's user avatar
7 votes
Accepted

Unable to access Apex in namespaced scratch org

Something was wrong with my scratch org. After I recreate it 2 times it worked without adding any namespaces. I didn't delete my question as this might happen others and then the thread is helpful. ...
Robert Sösemann's user avatar
7 votes
Accepted

Why can't we package custom AuthProvider in Managed Package

Auth Provider is org specific. It has a callback URL where a connected app redirects after authentication and org get authcode and complete the rest authentication steps. If salesforce allows Auth ...
Sushant Srivastava's user avatar
7 votes

Packaging Connected App in 2gp package - CLI says package is deleted?

You don't actually need to package the Connected App, especially when all/many of your clients use the same connected app with the same secret/ID and same mobile app (for example). The important thing ...
Phil W's user avatar
  • 37k
7 votes
Accepted

How different is Initial Security Review from Resubmission

I've gone through a resubmission last year. To be fair, the process was fairly straightforward (exactly the same as a normal submission) - but that's because I kept the resubmission in mind after my ...
user7038758's user avatar
6 votes
Accepted

Is retrieving data from REST API in Apex consistent with ISV security guidelines?

There shouldn't be any problem; after all, the REST API won't give users any more access than they'd have in the UI (e.g. you can't query records you couldn't view in the UI, etc). They will, of ...
sfdcfox's user avatar
  • 497k

Only top scored, non community-wiki answers of a minimum length are eligible