# Salesforce Authentication and Integration

This article outlines the process of user creation and authentication configuration in Salesforce sales cloud, covering account setup, organization level OAuth settings, login access, and the enablement of connected apps for integration, and defines the steps needed to manage user access and set up secure application connectivity through token based and JWT based authentication methods, ensuring that user credentials, authentication flows, and security settings are properly configured.

## User Creation in Salesforce sales cloud

### Log In to Salesforce

1. Navigate to the Salesforce login page:[ https://login.salesforce.com](https://login.salesforce.com)
2. Enter administrator credentials.
3. Click **Login**.

{% hint style="info" %}
Ensure the user has the appropriate administrative permissions to access user management features.
{% endhint %}

### Access User Management

1. Click the **Setup gear** icon in the top-right corner.
2. Select **Setup** from the dropdown.
3. In the **Quick Find search** bar on the left-hand side, type **Users**.
4. Click on **Users** under **Administration** > **Users**.

### Create a New User

1. Click **New User**.
2. A user creation form will open.

### Enter User Details

Complete the following fields in the form:

<table><thead><tr><th width="220.2222900390625">Field</th><th>Description</th></tr></thead><tbody><tr><td>First Name</td><td>Enter user’s first name</td></tr><tr><td>Last Name</td><td>Enter user’s last name</td></tr><tr><td>Alias</td><td>Auto-filled based on name or enter manually</td></tr><tr><td>Email</td><td>Enter user’s email address</td></tr><tr><td>Username</td><td>Must be in email format, unique across all Salesforce orgs</td></tr><tr><td>Nickname</td><td>Unique name for internal use</td></tr><tr><td>Role</td><td>Select appropriate role (e.g., Sales Rep)</td></tr><tr><td>User License</td><td>Select the appropriate license (e.g., Salesforce)</td></tr><tr><td>Profile</td><td>Select a profile such as Standard User or System Administrator</td></tr></tbody></table>

{% hint style="info" %}
The selected profile must have API Enabled permission and read access to all relevant objects and fields.
{% endhint %}

### Locale Settings (Optional)

Configure locale-specific settings:

* **Language**: User’s preferred language
* **Time Zone:** Based on user location
* **Locale**: Regional format for dates, times, and numbers

### Enable Login Notification

* Select the checkbox **Generate new password and notify user** immediately.
* Click **Save**.

{% hint style="info" %}
The user will receive an email with login credentials and a prompt to set a new password upon first login.
{% endhint %}

## First-Time Login for New User

* A welcome email with a temporary password is sent to the user.
* User logs in with Username and temporary Password.
* Users are prompted to set a new password on first login.

## Token-Based Authentication Configuration

### Enable Connected App Creation

* Navigate to **Setup**.
* In the **Quick Find search** box, search for **External Client Apps.**
* Click on **Settings**.
* Ensure the checkbox **Allow users to create connected apps** is selected.

### Create a New Connected App

* Navigate to **Setup** > **App Manager.**
* Click **New Connected App.**

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2Fl0c0Z0FuFhT9Gn6ITL5r%2Fimage.png?alt=media&#x26;token=7a62e454-1c6e-48d0-ae99-8aab078da599" alt=""><figcaption></figcaption></figure>

### Provide Basic App Information

**Complete the following fields:**

| Field              | Description                                        |
| ------------------ | -------------------------------------------------- |
| Connected App Name | E.g., MyApp Integration                            |
| API Name           | Auto-populated based on the App Name               |
| Contact Email      | Enter a valid email for support and identification |

## Configure OAuth Settings

### Enable OAuth

* Scroll down to the **API (Enable OAuth Settings)** section.
* Check **Enable OAuth Settings**.

### Define Callback URL

* Enter the Callback URL: <https://login.salesforce.com/services/oauth2/callback>

### Assign OAuth Scopes

Move the following scopes to the **Selected OAuth Scopes** box:

* Access and manage your data (API)
* Perform requests on your behalf at any time (refresh\_token, offline\_access)

{% hint style="info" %}
Use the arrows between the boxes to move the scopes.
{% endhint %}

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FQoIfbigJlQA4aM4zuPT9%2Fimage.png?alt=media&#x26;token=9aa05ea3-4216-41e9-953d-ab19ca09f0dc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FNuimyjQvjgrfmCRiZXne%2Fimage.png?alt=media&#x26;token=087c7300-ab32-4c65-b1b2-c78caaf5203d" alt=""><figcaption></figcaption></figure>

## Configure Additional App Security Settings

Ensure the following are checked:

* Require Secret for Web Server Flow
* Require Secret for Refresh Token Flow
* Require Proof Key for Code Exchange (PKCE)

{% hint style="info" %}
These settings improve security for authorization flows.
{% endhint %}

* Click **Save**.

{% hint style="info" %}
App credentials may take up to 10 minutes to become active.
{% endhint %}

### Manage Connected App Policies

* Go to **Setup** > **App Manager.**
* Find the connected app, click the **dropdown arrow,** and select **Manage**.
* Click **Edit Policies.**

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FwIAjqE10PWH70aD00J3V%2Fimage.png?alt=media&#x26;token=fdf3df19-4f1b-42a5-a302-e63e015a9eaa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2Fp26iqcgeGmzq6xjzLMOo%2Fimage.png?alt=media&#x26;token=4603501f-b019-41c4-a689-91a4f14e9bd8" alt=""><figcaption></figcaption></figure>

**Update the Following:**

<table><thead><tr><th width="221.111083984375">Setting</th><th>Value</th></tr></thead><tbody><tr><td>IP Relaxation</td><td>Relax IP restrictions (recommended when the app will be accessed from multiple or dynamic IP addresses)</td></tr><tr><td>Permitted Users</td><td>Admin approved users are pre-authorized (ensures only users with assigned permission sets or profiles can use the app.)</td></tr></tbody></table>

* Click **Save**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FiSph8zl8qDttJlxgE3Nz%2Fimage.png?alt=media&#x26;token=dc873866-3ad5-4302-b748-ea192e9825eb" alt=""><figcaption></figcaption></figure>

### Retrieve Consumer Key and Secret

* Go to **App Manager** > **locate the connected app** > click the **dropdown** > **View**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FTtF7jijMTm9wsJCEif03%2Fimage.png?alt=media&#x26;token=320d456f-601b-4a3e-8582-1bc82c051a05" alt=""><figcaption></figcaption></figure>

* On the **Connected App** detail page, click **Manage Consumer Details**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2F1HdlDRmzihuSmxLGLayF%2Fimage.png?alt=media&#x26;token=2305d76c-1242-4f9a-8d08-35c253a375a0" alt=""><figcaption></figcaption></figure>

* Re-authenticate when prompted.
* After login, the following will be visible:
  * **Consumer Key**: Used as Client ID in integrations
  * **Consumer Secret**: Used to authenticate OAuth requests
* View and note the **Consumer Key and Consumer Secret**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FE7qdpKmB6RmkiBlpHqG0%2Fimage.png?alt=media&#x26;token=6157c4f5-0aca-4106-8e62-43aae2506b1a" alt=""><figcaption></figcaption></figure>

## JWT-Based Authentication Configuration

### Generate a Self-Signed Certificate

* In **Setup**, search for **Certificate and Key Management.**
* Click **Create Self-Signed Certificate.**

Fill in the following:

* **Label**: Descriptive name
* **Unique Name (Also known as Alias name)**: Auto-generated or custom (must be alphanumeric with underscores only, no spaces or consecutive underscores)
* **Key Size:**
  * 2048-bit (1-year validity, faster)
  * 4096-bit (2-year validity, more secure)

{% hint style="info" %}
Once saved, type or key size cannot be changed.
{% endhint %}

* Click **Save**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FRMj9q9GgZhJ9gUkIIxOA%2Fimage.png?alt=media&#x26;token=fa23adac-65bc-4898-9c19-27eaa3e2da01" alt=""><figcaption></figcaption></figure>

### Download the Certificate

* After saving, click on the **certificate** label.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2Fo1xhbkIYFIHFPH5KUlSg%2Fimage.png?alt=media&#x26;token=07115c5c-d2ec-421b-9218-ccbaf3dba497" alt=""><figcaption></figcaption></figure>

* Download the **certificate**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FgeFrWueGoOOeA7kXNKVc%2Fimage.png?alt=media&#x26;token=0d108185-d485-45f6-b9a2-380871b8f6f4" alt=""><figcaption></figcaption></figure>

### Upload Certificate to Connected App

* Edit the previously created connected app.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2F9jWAugFislMQCw3AJEh6%2Funknown.png?alt=media&#x26;token=feab7e03-7d51-453d-81a8-4fc0c13668c6" alt=""><figcaption></figcaption></figure>

* Select **Use digital signatures.**
* Upload the downloaded **certificate**.
* Update **OAuth scopes** to include:
  * **Manage user data via APIS (api)**
  * **Perform requests at any time (refresh\_token, offline\_access)**

{% hint style="info" %}
Use the arrow button to move selected scopes from the left box to the right.
{% endhint %}

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FPQ9rX4L1Ty5sGBmxJNKu%2Funknown.png?alt=media&#x26;token=aa103ff4-24ed-48c2-8d52-48097140c342" alt=""><figcaption></figcaption></figure>

### Edit OAuth Policies

Update the following settings:

* **IP Relaxation:** Relax IP restrictions
* **Permitted Users**: Admin-approved users are pre-authorized
* Click **Save**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FkHSoiyFVm2CIJK5UQ8Ln%2Funknown.png?alt=media&#x26;token=bed3e8c6-f5c6-467f-9955-df3d1ca2bebd" alt=""><figcaption></figcaption></figure>

### Export Java KeyStore (JKS) File

* After configuring the app, export the **JKS** file using the **certificate** created in Salesforce.
* Navigate to the **Certificate and Key Management** screen.
* Click **Export to Keystore.**

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FEUFHfXYsgjf70jefojxA%2Funknown.png?alt=media&#x26;token=7938e9a2-2c90-4fdd-8d9c-7665d6544461" alt=""><figcaption></figcaption></figure>

* On the **Keystore password** screen, enter a secure **password** and click **Export**.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FNIBNk9fPozhV5byzSw2S%2Funknown.png?alt=media&#x26;token=61fe148c-4518-42ec-9860-d2509bc7cb82" alt=""><figcaption></figcaption></figure>

* The **JKS file** will be automatically downloaded to the local system.
* Ensure the downloaded **JKS file** is stored in a secure location.
* Make sure that the downloaded **JKS file** is accessible to the **OvalEdge application** for authentication and integration.

{% hint style="info" %}
Avoid modifying or relocating the JKS file after integration is configured, as it may disrupt connectivity.
{% endhint %}

### Integration Configuration Parameters

**Use the following credentials for JWT-based integration:**

| Parameter                              | Description                                                             |
| -------------------------------------- | ----------------------------------------------------------------------- |
| Client ID (Also known as Customer Key) | Use the Consumer Key from the Connected App                             |
| Username                               | Salesforce user’s username                                              |
| Alias Name                             | Alias of the certificate in the JKS file                                |
| Keystore Password                      | Password set during the JKS export process                              |
| Keystore File Path                     | Full path to the stored JKS file accessible by the OvalEdge application |

{% hint style="info" %}

* Ensure users assigned to use the app are granted appropriate permission sets or profiles.
* Store Consumer Secret securely and do not expose it in public repositories.
* Monitor app activity through Connected App usage logs in Salesforce.
  {% endhint %}

## Additional Settings

### OAuth and OpenID Connect Settings Configuration

Configure Org-Level OAuth Settings Before creating connected apps, the specific OAuth flows required for authentication must be enabled.

#### Navigate to OAuth Settings

1. In the Salesforce Setup **Quick Search** box, enter **OpenID** or **OAuth**.
2. Select the **OAuth** and **OpenID Connect Settings** located under the **Identity** menu.

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FnpPy6YZZPt6TjHoAy03v%2Fimage.png?alt=media&#x26;token=7f8e0684-f70f-4740-9f70-ee04a81cbac8" alt=""><figcaption></figcaption></figure>

#### Enable Required OAuth Flows

To support specific authentication methods, such as the username-password flow, users must enable the corresponding OAuth settings at the organization level.

**Steps to Configure:**

1. Navigate to the **OAuth** and **OpenID Connect Settings** section.
2. Locate the setting labeled **Allow OAuth Username-Password Flows**.
3. Set the toggle to **On**.
   * Purpose: This setting enables the legacy OAuth 2.0 username-password flow, which is required for applications that authenticate by sending a username, password, and security token directly (e.g., automated scripts, Postman, or legacy integration tools).

<figure><img src="https://1813356899-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhTnkoJQml0pok9awFDhx%2Fuploads%2FCOKW0wUXR67UlIIzoVPW%2Funknown.png?alt=media&#x26;token=272b5261-3817-4ef3-9b0a-f25bc74cb615" alt=""><figcaption></figcaption></figure>

**Configuration Reference**

Use the table below to verify if a setting is required for the specific integration scenario:

<table><thead><tr><th width="179.6666259765625">Setting Name</th><th width="214.6666259765625">Action Required</th><th>Notes</th></tr></thead><tbody><tr><td>Allow OAuth Username-Password Flows</td><td>Enable if using username/password flow (e.g., scripts, Postman).</td><td>This also requires the "Enable Username-Password Flow" setting to be enabled within the Connected App configuration itself.</td></tr></tbody></table>

{% hint style="info" %}
For JWT-based authentication using a certificate (.jks), the above org-level toggles are strictly required. JWT relies on the certificate upload and pre-authorization in the Connected App.
{% endhint %}

***

Copyright © 2025, OvalEdge LLC, Peachtree Corners GA USA<br>