Create Salesforce Credentials for the Connector
Purpose: This page explains how to create the Salesforce credentials needed for the connector using a Salesforce Connected App and the Client Credentials OAuth flow.
Use this guide to collect the three values typically needed for configuration:
Salesforce Site URL
Consumer Key
Consumer Secret
What You Need Before You Start
Access to the target Salesforce org
Salesforce admin permissions, or help from a Salesforce administrator
The correct Salesforce instance URL
Permission to create and manage Connected Apps
Important: The Client Credentials flow runs as a specific Salesforce user. That user must be an admin-level user for the org and must have API access enabled.
Step 1: Get the Salesforce Site URL
Your Salesforce site URL is your Salesforce instance URL.
For example:
SALESFORCE_SITE=https://yourdomain-dev-ed.develop.my.salesforce.com
Note: Do not include a trailing slash at the end of the URL.
Step 2: Create a New Connected App
In Salesforce, go to:
Setup → App Manager → External Client Apps → Settings → New Connected App
Create the app and enable OAuth settings during setup.
Configure the Connected App
Create the app and enable OAuth.
Set the Callback URL to
https://localhost.
Why this callback URL? It is not actually used for this integration, but Salesforce requires a callback URL to be entered. https://localhost is a standard placeholder.
Select OAuth Scopes
For the Client Credentials flow, select these minimum scopes:
Manage user data via APIs (
api)Perform requests at any time (
refresh_token,offline_access)
Also make sure this setting is disabled:
Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows
Best practice:
If the connector still fails after setup, you can also add:
Full access (
full)
Security caution: The full scope grants broader access than is usually necessary. Only use it if required, because it increases risk if the credentials are ever compromised.
Enable Client Credentials Flow
In the OAuth settings section of the Connected App, select the checkbox for Enable Client Credentials Flow.
Important: You can enable the flow when creating the app, but the Run As user must be configured after the app is saved.
Step 3: Save the App and Configure Policies
Save the Connected App.
Open the app and select Manage.
Go to Edit Policies.
Set OAuth Policies
Update the following policy:
Permitted Users → Admin Approved Users and Pre-Authorized
Set the Client Credentials Run As User
For Client Credentials Flow, set the app to run as the Salesforce admin user for the org.
This should be the user who owns or manages the Salesforce instance and has API access permissions.
Important: If the selected Run As user does not have the right permissions, the connector may authenticate successfully but still fail when trying to access Salesforce data.
Save the policy changes.
Step 4: Get the Consumer Key and Consumer Secret
After saving the app and policies:
Go to App Manager.
Find your Connected App.
Select View.
Select Manage Consumer Details.
Copy the Consumer Key and Consumer Secret.
Result: You now have the credentials required for the connector.
Credentials to Provide
Once setup is complete, provide these values:
Salesforce Site URL
Consumer Key
Consumer Secret
Quick Reference
Item | Value or Setting | Notes |
|---|---|---|
Salesforce Site URL |
| No trailing slash |
Callback URL |
| Required by Salesforce, not used by the connector |
Required scopes |
| Minimum recommended scopes |
Optional fallback scope |
| Use only if needed |
PKCE requirement | Disabled | Turn off PKCE for supported authorization flows |
Permitted Users | Admin Approved Users and Pre-Authorized | Set in OAuth Policies |
Run As user | Salesforce admin user | Must have API access |