Salesforce Connected Apps and External Client Apps
Striim's Salesforce adapters authenticate using OAuth through an app registered in your Salesforce org. Salesforce supports two frameworks for these apps: the legacy Connected Apps and their replacement, External Client Apps (ECAs).
Starting with Salesforce's Spring '26 release, creation of new Connected Apps is disabled by default in all orgs, through both the UI and the API. Customers can request a temporary exception from Salesforce Support, but Salesforce has indicated that this option will be removed in a future release and that Connected Apps are moving toward end of support. Existing Connected Apps continue to work without disruption, and there is currently no announced deprecation date for them. For details, see Salesforce Platform: New Connected Apps Can No Longer Be Created in Spring '26 in Salesforce's documentation.
For any new integration with an adapter that supports External Client Apps, create an External Client App. For an overview and creation instructions, see External Client Apps in Salesforce's documentation.
Note
Salesforce Pardot Reader does not support External Client Apps, and does not support the CLIENT_CREDENTIALS flow. Use a Connected App with the PASSWORD or JWT_BEARER flow.
Authentication modes and supported app types
The following table shows which app type supports each authentication mode for Salesforce Reader, Salesforce CDC Reader, and Salesforce Writer. For Salesforce Pardot Reader, see the note above.
Authentication mode | Connected App | External Client App |
|---|---|---|
Manual OAuth, PASSWORD flow | Supported | Not supported. External Client Apps do not support the username-password flow. To use an ECA, use the JWT_BEARER or CLIENT_CREDENTIALS flow instead. |
Manual OAuth, JWT_BEARER flow | Supported | Supported |
Manual OAuth, CLIENT_CREDENTIALS flow (new in 5.4.2) | Supported | Supported |
Automated OAuth using a connection profile | Supported (uses Striim's Connected App) | Not applicable |
Authentication using a Salesforce connection profile (Automated OAuth) is unaffected by the Spring '26 change and continues to work without any action on your part.
In each adapter, the Manual OAuth flow is selected with the OAuth Authorization Flows property, which appears when Auto Auth Token Renewal is enabled. See the adapter's programmer's reference for the properties each flow requires.
Migrating from a Connected App to an External Client App
If your Striim applications authenticate through a Connected App you created, it continues to work, but Salesforce recommends proactively migrating to an External Client App to prepare for the eventual end of support. Salesforce provides a migration option that converts a connected app to an external client app: see Create an External Client App from a Connected App and Connected App to External Client App Migration in Salesforce's documentation.
Notes on migration:
Do not migrate a Connected App that Salesforce Pardot Reader uses, because Salesforce Pardot Reader does not support External Client Apps.
Migration typically takes 1 to 3 minutes. A running Striim application does not halt during migration: it continues to run with the same credentials, and no re-authentication is required afterward.
Migration is one-way. An External Client App cannot be converted back to a Connected App; after migration, the original Connected App remains visible as a read-only entry in App Manager.
If your adapters use the PASSWORD flow, switch to the JWT_BEARER or CLIENT_CREDENTIALS flow before migrating, because External Client Apps do not support the username-password flow.
Local External Client Apps are not copied when a Salesforce sandbox is cloned or refreshed; only packaged ECAs are. If you test Striim applications against a sandbox, plan to recreate the ECA (or use a packaged ECA) after a sandbox refresh.