Hello, trying to upgrade our package from using a "Connected App" to an "External Client App" and I'm having trouble getting the client secret and key, for use in the webserver flow.
We have 3 environments:
1. org/dev hub (hub)
2. package development (dev)
3. package testing (qa)
I tried creating the app in dev (local and packaged) and got "Insufficient Privileges" page after user verification.
I read that it had to be created in a dev hub in order to be able to read it, so I enabled the dev hub on our environment hub, and tried there (again both local and packaged) and got the same "Insufficient Privileges" page.
I created a local app in qa, just to see and I can reach the secret there, but I think that would mean our client would need to create an app for us to connect on, which is not what we want.
Users for each env are System Administrators. I've also tried creating a permission set with the recommended permissions, but it wouldn't allow me to assign my sysadmin user.
#External Application #Consumer Secret
Hey Marc,
Two documented causes match your symptoms exactly:
1. Missing profile permission (most likely first check)
Your profile needs the specific permission "View all External Client Apps, views their settings, and edit policies." System Administrator profile usually has broad access, but this is a distinct, separate permission from general admin rights, if it's not explicitly enabled on your profile (or if your org customized the System Admin profile), you'll get exactly this "Insufficient Privileges" page after verification. Check Setup > Profiles > your profile > System Permissions, confirm this specific one is checked.
2. Permission Set License not synced to sandbox (matches your multi-env setup)
There's a documented issue where the External Client App framework requires a specific Permission Set License, and if your Production/Hub org has it but your Sandbox (dev/qa) wasn't refreshed after that license was added, the sandbox literally doesn't have the underlying license, so the UI permission stays inactive even for System Admins. Fix: Setup > Company Information > click "Match Production Licenses" in the sandbox, then check if the External Client App Permission Set License now appears under Permission Set Licenses. This would explain why qa worked (possibly synced more recently) while dev/hub didn't.
On your permission set issue specifically, permission sets can't grant this, it's a Permission Set License requirement, not a regular permission, that's likely why assigning it to your user failed or didn't help, licenses need to exist at the org level first before any permission set/profile setting can actually take effect.
Reference:
https://help.salesforce.com/s/articleView?id=000384703&language=en_US&type=1
