Connected App

A connected app registers an external application, an integration, a CI runner, a mobile client, with Salesforce's OAuth layer, defining callback URLs, scopes, and IP relaxation settings that control how that application authenticates and what it can access. Connected app metadata deploys through the standard API, but the consumer secret isn't included in the deployed metadata for security reasons, so every new environment needs its own credential exchange or a Named Credential pointing at the right connected app, which means “the deploy succeeded” and “the integration actually works in this org” are two different checkpoints. Because scopes and IP restrictions are set per connected app per org, a policy that's correctly locked down in production can be looser in a sandbox without anyone noticing until a security review flags it. Our Salesforce authentication migration guide covers connected app setup in more detail.