Salesforce

### App
Salesforce

### Summary:
Connect managed Salesforce (`salesforce_rest_api`) fails with `OAUTH_EC_APP_NOT_FOUND` / generic "Connection failed" — no custom `oauthAppId`

### Details:
Hi Pipedream team,

We’re integrating Salesforce via "Pipedream Connect managed OAuth" (no custom OAuth client). End users connect from our app (Ballet) using the Connect frontend SDK. We’re seeing a consistent failure when connecting Salesforce.

### Environment
- **Connect project ID:** `proj_qzs…` (full ID available on request)
- **Environments tested:** `development` and `production` (`x-pd-environment`)
- **App slug:** `salesforce_rest_api`
- **SDK:** `@pipedream/sdk` `3.1.1` (browser `createFrontendClient` → `connectAccount`)
- **Custom OAuth client:** none configured / none passed (`oauthAppId` is not set)

### What we do
1. Create a Connect token via `POST /v1/connect/{project_id}/tokens` with `external_user_id` (our tenant id) and `allowed_origins`.
2. Open Connect with:

```ts
pd.connectAccount({ app: "salesforce_rest_api" })
// no oauthAppId
```

3. After a successful connect we would use the Connect **proxy** (managed Salesforce returns no raw credentials). Failure happens **before** we get an `apn_…` account id.

### Observed errors
- **Development:** Connect iframe shows `OAUTH_EC_APP_NOT_FOUND` (Salesforce External Client App “app not found”), yellow Development Mode banner.
- **Production:** Same flow shows branded generic copy:
`Connection failed. Please retry or contact support at hello@brainfi.sh.`
(no Development Mode banner)
- SDK `onError` receives an **empty** error string (`e.data.error` is `""`), while the iframe still shows the failure UI.

### What we’ve already ruled out on our side
- We are **not** passing `oauthAppId` (confirmed in Connect iframe query: only `token` + `app=salesforce_rest_api`).
- App slug is correct; Salesforce branding appears in the Connect UI.
- Connect token creation succeeds.
- This is the **managed** path — we intentionally do not use a custom Salesforce OAuth client in Pipedream (and have no Salesforce client under OAuth Clients for this).

### Ask
1. Is the **managed** Salesforce OAuth client for `salesforce_rest_api` healthy for Connect (dev + prod) on our project?
2. Under what conditions does Connect surface `OAUTH_EC_APP_NOT_FOUND` for managed Salesforce (e.g. target org type, ECA distribution / install requirements, recent changes to the managed client)?
3. Can you confirm whether end-user Salesforce orgs need any install/approval of Pipedream’s Salesforce app for managed Connect to work, and whether that differs for System Admins vs non-admins?
4. Why does the parent-frame `postMessage` error payload come through empty while the iframe shows a specific failure?

Happy to share project id, timestamps, HAR/network capture of the authorize redirect (`client_id`), and which Salesforce org type we tested (Developer Edition / sandbox / production).

Thanks,
Vivek Suyambu
Ballet / Brainfish
vivek@brainfi.sh

### Screenshots:


No repository files or tests are identified. Start with the @pipedream/sdk createFrontendClient/connectAccount flow and reproduce the managed Salesforce connection in development and production, comparing the iframe error with the parent-frame postMessage payload. Done means determining the cause of the managed OAuth failure and documenting the expected org requirements and error propagation.

Written by the indexing model from the issue text.