The external client apps framework, a new and improved generation of connected apps, is catching up to connected apps fast. The new framework now supports headless login, passwordless login, and guest user flows using the Authorization Code and Credentials Flow. You can also configure an external client app to issue JSON Web Token (JWT)-based access tokens.
Where: The changes to support the Authorization Code and Credentials Flow apply to LWR, Aura, and Visualforce sites accessed through Lightning Experience and Salesforce Classic in Enterprise, Unlimited, and Developer editions. The changes to support JWT-based access tokens apply to Lightning Experience and Salesforce Classic in Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.
Why: Unlike the connected apps framework, the external client apps framework is compatible with second-generation packaging (2GP), making apps easier to package and distribute. It’s also more secure and fully metadata-exposed. And its design makes it easy to define clear roles for developers and admins.
How: Create and edit external client apps via the External Client App Manager in Setup, or use Metadata API. External client apps currently support all variations of the Authorization Code and Credentials Flow except headless registration.