Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

ARM: Salesforce ECA Connection Setup Steps

This is a step by step on how to implement the Local ECA solution to establish a new connection with ARM.

1

Pre-req: get your Callback URL (redirect URI)

For AutoRABIT’s ARM ECA setup, you need the callback URL

Callback URL is depending on the instance:

{$instancename}/oauth/_callback

Example:

https://arm-qan5.autorabit.com/oauth/_callback
2

Create the External Client App (ECA) in your Salesforce Org

  1. Login into Salesforce

  1. In Salesforce, go to Setup.

  2. In Quick Find, search External Client Apps.

  3. Open External Client App Manager (or the External Client Apps area).

  1. Click New External Client App.

  2. Fill in the basics:

  • Name / Label ( e.g. AR_Local)

  • API Name (auto-filled)

  • Contact Email

  • Distribution State:

    • Local (only for this org)

3

Important Note: After creating the ECA in Salesforce, there may be a replication delay on the Salesforce side. If you encounter the error error=invalid_client_id&error_description=client%20identifier%20invalid while attempting to connect or register the org, please wait 30 minutes, then try again to allow the Salesforce configuration to sync completely

4

Enable OAuth + set callback URL + scopes

  1. Click Enable OAuth (or expand API (Enable OAuth Settings) and check Enable OAuth).

  2. Set *Callback URL

The URL you collected in step 1.

  1. Choose OAuth Scopes:

  • Access the identity URL service (id, profile, email, address, phone)

  • Manage user data via APIs (api)

  • Full access (full)

  • Access Connect REST API resources (chatter_api)

  • Perform requests at any time (refresh_token, offline_access)

  • Access custom permissions (custom_permissions)

5

Flow Enablement

  1. In Flow Enablement, select Enable Authorization Code and Credentials Flow.

  2. user credentials are required in the POST body (Salesforce shows this option when you choose that flow) should be disabled.

6

Security toggles (common defaults)

In the Security section the next options should be enabled:

  • Require secret for Web Server Flow

  • Require secret for Refresh Token Flow

  • Enable Refresh Token Rotation(Auto Selected)

  • Limit Idle Refresh Token Time-to0Live (TTL) to 30 days(Auto Selected)

Note: If this Salesforce Org remains inactive for 30 days, the refresh token will expire. You must manually re-authenticate the registered Org from the ARM application before it can be used again.

7

Create the app and capture Client ID / Secret

  1. Click Create.

  2. Open the app’s Settings tab and locate Consumer Key and Secret:

  • Consumer Key = Client ID

  • Consumer Secret = Client Secret

When you click the button for Consumer Key and Secret a code will be sent to the registered email for the user creating the configuration

After getting the code and verify in Salesforce the Consumer Key (CliendID) and Consumer Secret (Client Secret) will be displayed.

IMPORTANT: STORE THIS VALUES IN A SAFE PLACE WHERE CAN BE EASILY USED FOR FUTURE REFERECES.

8

Configure Policies (very important)

After creating the ECA, open the Policies tab and adjust as needed (exact options vary by org/security posture), commonly:

  • Permitted Users: often set to Admin approved users are pre-authorized for controlled rollouts.

  • Add the required profiles/permission sets (or approved users) for who is allowed to authorize.

9

What you’ll use in AutoRABIT

Once created, the set of values you’ll reference in your ARM configuration are:

  • Client ID

  • Client Secret

Also, the internal direction is to be clear that one ECA per customer org can be used across products (rather than creating one per AR product).

After the configuration in salesforce is complete, and you have obtained the ClientID and Client Secret, we can go to ARM to create the connection

In the menu Click in Salesforce org and click in register Salesforce org

Create the connections filling the required information obtained from Salesforce.

Important Note: After creating the ECA in Salesforce, there may be a replication delay on the Salesforce side. If you encounter the error error=invalid_client_id&error_description=client%20identifier%20invalid while attempting to connect or register the org, please wait 30 minutes, and try again to allow the Salesforce configuration to sync completely.

Once the Validate and save button is clicked a salesforce login is shown to login with the user we intend to use for the Connection.

A message from Salesforce will show to require granted permissions for the user to use the scopes defined in the ECA, Click Allow

Then, you will be returned to ARM and the connection will be saved.

Important: This setup is Salesforce org-specific. You must repeat this process for each customer Salesforce org you want to connect, since the External Client App is created inside (and scoped to) that org and produces org-specific credentials.

PreviousSalesforce Org ReauthenticationNextRunning Static Code Analysis

Last updated

Was this helpful?