How to Configure OAuth and Security for a Salesforce App

Summary

This guide explains how to properly configure the OAuth and security settings for your External Client App in Salesforce. These settings are critical for enabling API access and ensuring the connection is secure.

When to Use This

Use this article after you have created an External Client App in Salesforce and need to configure its authentication protocols, permissions, and security features to allow a successful integration.

How to Configure OAuth and Security for a Salesforce App 3024x1964

Step-by-Step Instructions

1. Enable OAuth Settings: Within your app's settings, locate the 'API (Enable OAuth Settings)' section and check the 'Enable OAuth' box.
2. Set the Callback URL: Enter the specific 'Callback URL' provided by the external application you are connecting. This URL is required for the OAuth flow to complete.
3. Select OAuth Scopes: In the 'Available OAuth Scopes' list, choose the permissions your app needs and add them to the 'Selected OAuth Scopes' box. Common scopes include:
   • Access the identity URL service (id, profile, email, address, phone)
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
4. Configure Security Settings: Scroll down to the 'Security' section to enhance your app's security.
5. Enable Web Server Flow: Check the box for 'Require Secret for Web Server Flow'.
6. Enable Refresh Token Flow: Check the box for 'Require Secret for Refresh Token Flow'.
7. Enable PKCE: Check the box for 'Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows'.
8. Save Your Configuration: Click 'Save' to apply the new settings. Your Consumer Key and Secret will now be available.

Common Questions (FAQs)

Where do I find my Consumer Key and Secret? After you enable OAuth and save your app, the 'Consumer Key' (Client ID) and 'Consumer Secret' (Client Secret) will be displayed. Click to reveal the secret and copy both credentials.

What are OAuth Scopes? OAuth scopes are permissions that define what actions your app can perform and what data it can access in Salesforce. It's important to only grant the scopes that are necessary for the integration to function.

What happens if I enter the wrong Callback URL? An incorrect Callback URL will cause the authentication process to fail, as Salesforce will not be able to redirect the user back to your application correctly. You will typically see an error message indicating a URL mismatch.

Troubleshooting Tips

• Integration Fails with 'Forbidden' Error: This often indicates that the necessary OAuth scopes have not been granted. Review the required permissions for your integration and ensure they are added to the 'Selected OAuth Scopes'.
• PKCE Errors: If you encounter errors related to PKCE, confirm that both your external application and your Salesforce app settings have PKCE enabled. Mismatched configurations can cause the flow to fail.