Does anyone have any insight/best practices on managing key rotations in the new External Client Apps? Currently, it appears that one can only stage new keys via a specific API (staging new credentials is no longer available in the UI, as it was in the classic connected app). We have roughly 50 integrations across our enterprise and want to realign them to use the External Client App (Client Credentials OAuth flow) with a robust credential rotation schedule.
My original thought was to have the third-party stage the credentials and then consume them based on the steps shown here:
https://help.salesforce.com/s/articleView?id=xcloud.eca_stage_oauth_credentials.htm&type=5View
The necessary permissions to allow this require the following to be able to stage new credentials:
External Client App Consumer Secrets in Metadata
Create, edit, and delete External Client Apps
View all External Client Apps, view their settings, and edit their policies
Unfortunately, the actual endpoints for staging and consuming the new keys require the very broad permissions noted above, and now I'm wondering whether giving the integration the ability to rotate its own keys is a bad idea.
Does anyone have any best practices/thoughts on how to handle this?
Managing credential rotation in Salesforce External Client Apps should ideally stay centralized rather than giving third-party integrations full control, since the required permissions are quite broad and can create security risks. A better approach is to handle rotation through an internal process (like a secure backend or secrets manager), where you can stage, switch, and revoke keys safely across all integrations.
It’s similar to how scalable apps are managed—whether it’s enterprise systems or even a well-optimized video editing app, performance and security both depend on controlled updates rather than open access. I’ve seen similar optimization concepts discussed on platforms like modwinkapk dot com, where app efficiency and smooth performance are key focus areas.
