Skip to main content
You’ll create: an External Client App (modern, preferred) or a Connected App (legacy, still works) inside your Salesforce org. We’ll be able to read: records available through the API to the connecting user, bounded by their profile and sharing rules.
Edition check first. Salesforce Starter Edition does not include API access, so no OAuth integration can work at all. You need Enterprise, Unlimited, Developer, or a Sandbox.

​
Steps

1

Open External Client App Manager

Sign in to the Salesforce org you want to connect.Click the gear icon (top right) → Setup. In the Quick Find box, search for External Client App Manager and open it.If your org does not have it, use App Manager → New Connected App instead — the fields are nearly identical.
2

Create the app and enable OAuth

Click New External Client App and fill in:
  • External Client App Name: Voltai
  • API Name: Voltai
  • Contact Email: your admin email
  • Distribution State: Local
Tick Enable OAuth, then complete the OAuth section:
  • Callback URL: the redirect URI
  • Selected OAuth Scopes:
    • Manage user data via APIs (api)
    • Perform requests at any time (refresh_token, offline_access)
    • Access the identity URL service (id, profile, email, address, phone)
  • Require Secret for Web Server Flow: enabled
  • Require Proof Key for Code Exchange (PKCE): disabled
Leave PKCE unchecked. We do not currently send a code verifier, so enabling it will break the connection.
Click Create.
3

Set the policies

Open the app you just created, go to the Policies tab, click Edit, and set:
  • Permitted Users: All users may self-authorize
  • IP Relaxation: Relax IP restrictions
  • Refresh Token Policy: Refresh token is valid until revoked
Save.
4

Wait about 10 minutes

Salesforce caches new app metadata. Until propagation finishes, authorization fails with invalid_client_id even though everything is configured correctly.
5

Copy the Consumer Key and Secret

Back in the app’s overview, open Settings → OAuth Settings → Consumer Key and Secret and reveal both values.

​
Send us

For sandbox users, login_url should be https://test.salesforce.com. If you omit it we default to https://login.salesforce.com, which is only reliable when every end-user’s Salesforce session lives in the same org where you created the app.

​
Things to know

  • One production org with one My Domain? The login.salesforce.com default is fine.
  • Users spread across multiple Salesforce orgs under the same Trailblazer ID? Always set login_url to the specific org’s My Domain, or Salesforce routes the OAuth request to the wrong org and returns invalid_client_id.
  • Connected Apps behave identically for our purposes: Setup → App Manager → New Connected App.