For the complete documentation index, see llms.txt. This page is also available as Markdown.

Salesforce Client Credentials Configuration

Customer Configuration Guide

Configure Salesforce Client Credentials for ARVault

Create and secure a Salesforce External Client App for server-to-server integration with ARVault.

Purpose: This guide explains how to configure the OAuth 2.0 Client Credentials flow, authorize the dedicated integration user, retrieve the application credentials, and verify the setup before registering the Salesforce organization in ARVault.

Before you begin

  • Confirm that a dedicated Salesforce integration user is active and uses the Salesforce Integration license with the Salesforce API Only System Integrations profile.

  • Confirm that the ARVault Integration Access permission set uses the Salesforce API Integration license and is assigned to the integration user.

  • Use a monitored customer administrator mailbox for the External Client App contact email.

  • Confirm that My Domain is active for the Salesforce organization.

Configuration overview

1

Create the External Client App and enable OAuth

2

Configure OAuth policies and select the Run As user

3

Pre-authorize the ARVault permission set

4

Retrieve the Consumer Key and Consumer Secret

5

Record the Salesforce My Domain URL and complete the verification checklist

Create the External Client App

1

Open the External Client App Manager

In Salesforce Setup, go to External Client App Manager and select New External Client App.

2

Enter basic information

Field

Value

External Client App Name

ARVault Integration

API Name

ARVault_Integration (populated automatically)

Contact Email

A monitored customer administrator mailbox. Salesforce sends the credential verification code to this address.

Distribution State

Local for use with a single Salesforce organization.

3

Configure OAuth settings

Select Enable OAuth. The OAuth configuration fields expand.

In Callback URL, enter a valid HTTPS URL. Client Credentials does not use this value, but Salesforce requires it. Suggested value: https://localhost/no-redirect.

4

Select OAuth scopes

OAuth scope

Guidance

Manage user data via APIs (api)

Required.

Access the identity URL service (id, profile, email, address, phone)

Required so that /services/oauth2/userinfo returns the username used by ARVault.

Access unique user identifiers (openid)

Optional.

Perform requests at any time (refresh_token, offline_access)

Do not select. Client Credentials does not use refresh tokens.

Full access (full)

Optional and broader than api. Select only when a specific endpoint requires it.

5

Save the External Client App

Select Save to create the External Client App.

Configure OAuth policies

From the saved External Client App, open OAuth Policies from the left navigation or the available tab.

1

Set permitted users

Set Permitted Users to Admin approved users are pre-authorized.

2

Configure IP relaxation

Set IP Relaxation to Relax IP restrictions for the initial configuration. After ARVault outbound IP addresses are known, select Enforce IP restrictions and add the addresses as Trusted IPs.

3

Keep the default refresh token policy

Leave Refresh Token Policy at its default value because Client Credentials does not use refresh tokens.

4

Set the Run As user

Under Client Credentials Flow, set Run As to the dedicated ARVault integration user.

5

Save the OAuth policies

Select Save.

Session and security settings

Setting

Guidance

Access-token lifetime

The default is approximately two hours. The Integration User profile session timeout can be reviewed under Setup > Profiles > Salesforce API Only System Integrations > Session Settings > Session Times Out After. The organization-wide setting is under Setup > Session Settings > Timeout Value.

High Assurance / MFA

Not applicable to Client Credentials because there is no interactive user session. Ensure the integration profile is exempt if the organization applies stepped-up authentication policies.

PKCE

Not applicable. PKCE applies to the Authorization Code flow.

Single Logout

Not applicable because Client Credentials does not establish an interactive user session.

Refresh Token Rotation

Leave disabled because Client Credentials does not use refresh tokens.

Salesforce UI variation: Some organizations display a separate Policies or Security tab. If present, verify the selected scopes and leave Permission Sets and Profiles unchanged until completing the pre-authorization steps below.

Pre-authorize the integration user

Because Permitted Users is set to Admin approved users are pre-authorized, access must be granted through a profile or permission set. Permission-set-based authorization is recommended because it limits access to the dedicated integration user.

1

Locate App Policies

Open the External Client App detail page and locate App Policies.

2

Select the ARVault permission set

Under Select Permission Sets, locate ARVault Integration Access in Available Permission Sets.

3

Add the permission set

Move ARVault Integration Access to Selected Permission Sets.

4

Leave profiles empty

Leave Select Profiles empty. Profile-based pre-authorization would authorize every user assigned to that profile.

5

Save the changes

Select Save at the top of the page.

Older Salesforce UI: If the organization displays the older Connected App interface, use Permission Sets > Manage Permission Sets, add ARVault Integration Access, and save.

Retrieve the application credentials

1

Open the External Client App

Go to Setup > External Client App Manager and open ARVault Integration.

2

Manage consumer details

Open Settings > OAuth Settings > Consumer Key and Secret > Manage Consumer Details.

3

Enter the verification code

Enter the verification code sent by Salesforce to the External Client App Contact Email.

4

Copy the credentials

Copy the Consumer Key and Consumer Secret.

5

Store the credentials securely

Store both values securely. They are required when registering the Salesforce organization in ARVault.

Record the My Domain URL

1

Open My Domain settings

Go to Setup > My Domain.

2

Copy the Current My Domain URL

Copy Current My Domain URL without a trailing slash.

Environment

URL format

Production

https://.my.salesforce.com

Sandbox

https://--.sandbox.my.salesforce.com

Verification checklist

Troubleshooting

Symptom

Likely cause

Resolution

Permission-set assignment fails with The user license doesn't allow the permission

The permission set was created with License = --None-- or contains unsupported permissions.

Delete and recreate the permission set with License = Salesforce API Integration. The license cannot be changed after creation.

API Enabled is not visible

Expected behavior for the Salesforce API Integration permission-set license.

Continue without selecting API Enabled; the license grants API access automatically.

Metadata calls return INSUFFICIENT_ACCESS

Modify Metadata Through Metadata API Functions is missing or the active token predates the permission change.

Enable the permission and request a new Client Credentials token.

Apex metadata or Tooling API calls return INVALID_TYPE

Author Apex is missing.

Enable Author Apex and request a new token.

unsupported_grant_type

Enable Client Credentials Flow is not selected.

Open OAuth Flow Enablement, select Enable Client Credentials Flow, and save.

invalid_grant: user hasn't approved this consumer

Run As is blank or the permission set is not pre-authorized.

Select the integration user under Run As and add ARVault Integration Access to Selected Permission Sets.

Permission error remains after a permission change

The existing token contains the earlier permissions.

Request a new token from /services/oauth2/token.

404 or an HTML response from the token endpoint

The login.salesforce.com or test.salesforce.com endpoint is being used.

Use the organization's My Domain URL.

invalid_client

The Consumer Secret is incorrect, expired, or contains whitespace.

Retrieve the credential again and remove any unintended whitespace.

Salesforce resources

Was this helpful?