Salesforce Connected App

#Letting other orgs use "Log in with Salesforce" (packaged app)

An app created in one org only works for that org: signing in from another org fails with "Cross-org OAuth flows are not supported for this external client app". To serve other orgs, the app is distributed as a package, and each org installs it once (an admin step):

• Install link (managed package RapidForge, namespace mokahub; the package keeps its original name until a renamed version is published): https://login.salesforce.com/packaging/installPackage.apexp?p0=04tak000000sxxZAAQ (use test.salesforce.com instead of login.salesforce.com for a sandbox). This is the released version 1.0.0.2, so it installs in production, sandbox and Developer Edition orgs.
• After installing, any user in that org can use Log in with Salesforce.
• Set SF_PACKAGE_URL on the server to that link and the Connect dialog shows it to your users.
• The packaged app's key and secret (SF_CLIENT_ID / SF_CLIENT_SECRET) are read from the Dev Hub org that owns it: Setup, External Client App Manager, RapidForge, Settings, OAuth Settings, Consumer Key and Secret.
• Source and rebuild steps: packaging/salesforce/README.md. The namespace org can't install its own package, so connect that org with an SFDX auth URL.

#Connected App (for "Log in with Salesforce")

Only for a single org, or if you don't want a package. Create it once, in any org you control (a Developer Edition is fine). It authorizes users of that org only.

1. Setup → App Manager → New Connected App (or External Client App in newer orgs).
2. Enable OAuth settings:
   • Callback URL: https://<your-domain>/api/orgs/oauth/callback (and http://localhost:8080/api/orgs/oauth/callback for local dev)
   • Scopes: Manage user data via APIs (api), Perform requests at any time (refresh_token, offline_access), Access the identity URL service (id, profile, email…)
   • Require PKCE: on. Diffbridge always sends a PKCE challenge.
   • Require secret for Web Server Flow: on.
3. Save, wait a few minutes, then copy the Consumer Key → SF_CLIENT_ID and Consumer Secret → SF_CLIENT_SECRET.
4. Optionally, under Manage → OAuth Policies, set refresh tokens to "valid until revoked".

Diffbridge stores only the refresh/access tokens, encrypted with AES-256-GCM (ENCRYPTION_KEY).

#SFDX auth URL (no Connected App needed)

Good for CI service users and scratch orgs:

sf org login web --alias uat --instance-url https://test.salesforce.com
sf org display --verbose --target-org uat --json | jq -r .result.sfdxAuthUrl

Paste the force://… value under Connections → Connect org → SFDX auth URL.

#Permissions for the integration user

The connecting user needs Modify Metadata Through Metadata API Functions (or Modify All Data), API Enabled, and Author Apex to run tests. For production deployments, use a dedicated integration user and turn on Approvals for that org in Diffbridge.

#How Smart tests map to Salesforce rules

Tests are discovered by: test classes in the package, naming conventions (FooTest, Foo_Test, TestFoo…), test classes that reference the changed class, and — for triggers — tests that touch the trigger's sObject.