It's possible to create a "Packaged" ECA and use this directly in the org it's created in and its sandboxes, i.e. never actually packaging this.
QUESTION: Is this officially supported approach, or any reason not to do this?
It seems very helpful because:
- The distribution state of "packaged" means this app cascades to sandboxes
- It has benefits over a connected app because the policies (e.g. preauthorised users) exist in the sandbox but are applied for the same client credentials used in production
- There's no pacakging overhead
But it's weird to create a "packaged" app which will never be packaged! Could behaviours supporting this workflow change in future or is it OK to roll out apps to be used in this way?
Would be great to hear a steer from Salesforce identity folks if possible. Thank you!!
Yeah, you can totally do that and it works fine today, but it’s kind of an “unofficial” side effect rather than a documented best practice. Since Salesforce doesn’t explicitly say this is supported long-term, there’s always a small risk they change how packaged ECAs behave across sandboxes. If you go this route, just be ready to adjust later or keep an alternative plan using a standard connected app.
