> For the complete documentation index, see [llms.txt](https://knowledgebase.autorabit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.autorabit.com/fundamentals/faq/salesforce-external-connected-app-eca-configuration-for-autorabit/vault-salesforce-eca-local-connection-setup-steps.md).

# Vault: Salesforce ECA (Local) Connection Setup Steps

### Pre-req: get your Callback URL (redirect URI) <a href="#id-1-pre-req-get-your-callback-url-redirect-uri" id="id-1-pre-req-get-your-callback-url-redirect-uri"></a>

For AutoRABIT’s Vault ECA setup, you need **the callback URL**

Callback URL is depending on the instance:

```
{$isntancename}/dashboard/setup/addSfOrg
```

Example:

```
https://vault-qa.autorabit.com/dashboard/setup/addSfOrg
```

{% stepper %}
{% step %}

### Create the External Client App (ECA) in your Salesforce Org

1. Login into Salesforce

<figure><img src="/files/Arcav6tS5IY9Vj1kIpUd" alt=""><figcaption></figcaption></figure>

2. In **Salesforce**, go to **Setup**.
3. In **Quick Find**, search **External Client Apps**.
4. Open **External Client App Manager** (or the External Client Apps area).

<figure><img src="/files/Q6d5Em5PpE0KeAq2pcpp" alt=""><figcaption></figcaption></figure>

5. Click **New External Client App**.
6. Fill in the basics:

* **Name / Label ( e.g. AR\_Local)**
* **API Name** (auto-filled)
* **Contact Email**
* **Distribution State**:
  * **Local** (only for this org)

<figure><img src="/files/rmwJ3Cg5lSN2Y0kMLp6a" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
{% hint style="info" %}

### **Important Note:**  After creating the ECA in Salesforce, there may be a replication delay on the Salesforce side. If you encounter the error error=invalid\_client\_id\&error\_description=client%20identifier%20invalid while attempting to connect or register the org, please wait 30 minutes, then try again to allow the Salesforce configuration to sync completely.

{% endhint %}

{% endstep %}

{% step %}

### &#x20;Enable OAuth + set callback URL + scopes <a href="#arm-3-enableoauthsetcallbackurlscopes" id="arm-3-enableoauthsetcallbackurlscopes"></a>

1. Click **Enable OAuth** (or expand **API (Enable OAuth Settings)** and check **Enable OAuth**).
2. Set \**Callback URL*

   The URL you collected in step 1.
3. Choose **OAuth Scopes**:
   1. Access the Identity URL service (id, profile, email, address, phone)
   2. Manage user data via APIs
   3. Manage user data via web browsers (web)
   4. Full access (full)
   5. Perform requests at any time (refresh\_token, offline\_access.

<figure><img src="/files/JFuguDjhYVrz0qsxWfQR" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Turnment <a href="#arm-4-turnment" id="arm-4-turnment"></a>

1. In **Flow Enablement**, select **Enable Authorization Code and Credentials Flow**.
2. **user credentials are required in the POST body** (Salesforce shows this option when you choose that flow) should be disabled.

<figure><img src="/files/ok9xkP0Dex0UWpad5rmv" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Security toggles (common defaults) <a href="#arm-5-securitytoggles-commondefaults" id="arm-5-securitytoggles-commondefaults"></a>

In the **Security** section the next options should be enabled:

* **Require secret for Web Server Flow**
* **Require secret for Refresh Token Flow**
  {% endstep %}

{% step %}

### &#x20;Create the app and capture Client ID / Secret <a href="#arm-6-createtheappandcaptureclientid-secret" id="arm-6-createtheappandcaptureclientid-secret"></a>

1. Click **Create**.
2. Open the app’s **Settings** tab and locate **Consumer Key and Secret**:

* **Consumer Key** = **Client ID**
* **Consumer Secret** = **Client Secret**

<figure><img src="/files/ly8K1zwGnlrolIF4Axib" alt=""><figcaption></figcaption></figure>

When you click the button for Consumer Key and Secret a code will be sent to the registered email for the user creating the configuration

<figure><img src="/files/5hZU6KmIsL5SvHcoosdm" alt=""><figcaption></figcaption></figure>

After getting the code and verify in Salesforce the Consumer Key (CliendID) and Consumer Secret (Client Secret) will be displayed.

**IMPORTANT: STORE THIS VALUES IN A SAFE PLACE WHERE CAN BE EASILY USED FOR FUTURE REFERECES.**

<figure><img src="/files/VJMrwWNq2CUssdIe3ZzK" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Configure Policies (very important) <a href="#arm-7-configurepolicies-veryimportant" id="arm-7-configurepolicies-veryimportant"></a>

After creating the ECA, open the **Policies** tab and adjust as needed (exact options vary by org/security posture), commonly:

* **Permitted Users**: often set to **Admin approved users are pre-authorized** for controlled rollouts.
* Add the required **profiles/permission sets** (or approved users) for who is allowed to authorize.
  {% endstep %}

{% step %}

### What you’ll use in AutoRABIT <a href="#arm-8-whatyoulluseinautorabit" id="arm-8-whatyoulluseinautorabit"></a>

Once created, the set of values you’ll reference in your Vault configuration are:

* **Client ID**
* **Client Secret**

Also, the internal direction is to be clear that **one ECA per customer org** can be used across products (rather than creating one per AR product).

***

After the configuration in Salesforce is complete, and you have obtained the ClientID and Client Secret, we can go to Vault to create the connection

In the menu Click Salesforce Org Integration

<figure><img src="/files/gMP6TcQ0GNFV52Ylxss1" alt=""><figcaption></figcaption></figure>

Create the connections filling the required information.

<figure><img src="/files/m7PSagxfvNL4SMz6zfdC" alt=""><figcaption></figcaption></figure>

Enter the Client Id and Client Secret that you received from Salesforce

<figure><img src="/files/07SAjswHCXJAzVQhOHBf" alt=""><figcaption></figcaption></figure>

Once the continue button is clicked, a Salesforce login is shown for the user we intend to use with the connection.

<figure><img src="/files/P672oIMyZExSNxdRN7yD" alt=""><figcaption></figcaption></figure>

A message from Salesforce will show to require granted permissions for the user to use the scopes defined in the ECA, Click Allow

<figure><img src="/files/3SkodgUBp2O4xnx0m0Pt" alt=""><figcaption></figcaption></figure>

Then you will be returned and the connection will be saved.

<figure><img src="/files/L1MGR8kpK4wuI0PpPUUK" alt=""><figcaption></figcaption></figure>

Click finish and the success message will appear

<figure><img src="/files/Uw78Q15kLtAhuyFqKnih" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**Important:** This setup is **Salesforce org-specific**. You must repeat this process **for each customer Salesforce org** you want to connect, since the External Client App is created inside (and scoped to) that org and produces org-specific credentials.
{% endhint %}
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://knowledgebase.autorabit.com/fundamentals/faq/salesforce-external-connected-app-eca-configuration-for-autorabit/vault-salesforce-eca-local-connection-setup-steps.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.