Creating an External Client Application
-
Ensure that you have Salesforce administrator permissions to create and manage External Client Applications.
- Create an External Client Application. For more information, see Create an External Client App.
- In Salesforce Setup, enter External Client App Manager in the Quick Find box and select External Client App Manager.
-
Click New External Client App.
-
In the Basic Information section, provide the following details:
-
External Client App Name: Enter a name for the application.
-
Contact Email: Enter an administrator or support email address.
-
Distribution State: Select Local if the application is intended for use only within the current Salesforce organization.
-
- Enable and Configure OAuth:
- Expand API (Enable OAuth Settings).
-
Select Enable OAuth Settings.
-
In Callback URL, enter the applicable URL based on your MCP client:
Example: Claude: Enter https://claude.ai/api/mcp/auth_callback
-
Select the OAuth scopes required by the integration.
Example: Access MCP servers (mcp_api), Perform requests at any time (refresh_token)
-
Under Flow Enablement, select the authentication flow appropriate for your integration:
Example:-
Enable Client Credentials Flow
- Enable Authorization Code and Credentials Flow
-
-
Under Security, select Security for your integration.
Example:-
Require secret for Web Server Flow
-
Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows
-
Issue JSON Web Token (JWT)-based access tokens for named users
-
-
Click Create.
- Configure Admin Policies (Crucial for Security):
- Open External Client App Manager.
-
Locate the application you created.
-
Open the Policies tab and click Edit.
-
Under OAuth Policies, set Permitted Users to Admin approved users are pre-authorized.
-
Assign the profiles or permission sets that are authorized to use the application.
-
Click Save.
- Retrieve Client Credentials:
- In External Client App Manager, locate the application.
-
Open the application Settings.
-
Navigate to OAuth Settings.
-
Click Consumer Key and Secret option.
-
Copy the following values: Consumer Key (Client ID), Consumer Secret (Client Secret)
