Salesforce: OAuth 2.0 Client Credentials

Method 2: OAuth 2.0 Client Credentials

💡 This is one of three ways to connect Salesforce to Cast. See choosing an authentication method for a comparison, or go back to the Salesforce Data Source overview.

Use this when your team would rather manage a rotating secret than a certificate. Queries run as a Run As user configured in Salesforce, so Cast never stores a username.

💡 This method requires My Domain. Salesforce rejects the Client Credentials flow on the shared login.salesforce.com host.

Step 1 — Choose the Run As user

Every API call Cast makes runs as one Salesforce user, and that user’s permissions decide what Cast can read. Use a dedicated integration user rather than a personal account, so the connection survives staff changes. Queries execute as this user.

The user must be active, API Enabled, and able to read the objects, fields and reports you want in Cast.

Step 2 — Confirm My Domain

Setup → My Domain, and copy the host, e.g. mycompany.my or the full URL https://mycompany.my.salesforce.com. Cast accepts either form.

Step 3 — Create an External Client App

Salesforce is replacing Connected Apps with External Client Apps. In most orgs, Setup → App Manager now offers only New External Client App.

1. Setup → search External Client App Manager
2. Click New External Client App
3. Fill in Name, Contact Email, and set Distribution State to Local
4. Expand API (Enable OAuth Settings) and check Enable OAuth
5. Callback URL: https://login.salesforce.com/services/oauth2/callback (Salesforce requires a value; this flow never uses it)
6. Selected OAuth Scopes — add both:
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
7. Under Flow Enablement, check Enable Client Credentials Flow. No certificate is needed for this method.
8. Leave Issue JSON Web Token (JWT)-based access tokens for named users unchecked — despite the name, it is an unrelated feature that changes the access token format and can break API access
9. Click Create

💡 Greyed-out security settings are fine. Newer orgs lock on PKCE, Refresh Token Rotation and an idle token limit, showing “To change this required setting, contact Support.” You do not need a Support case.

Wait 2–10 minutes after creating the app. Salesforce needs time to propagate it, and tests run immediately after creation often fail for that reason alone.

Step 4 — Copy the Consumer Key and Secret

1. Setup → External Client App Manager → click your app’s name
2. Open the Settings tab → expand OAuth Settings
3. Click Consumer Key and Secret (you may need to verify your identity with a code emailed to the app’s contact address)
4. Copy both the Consumer Key and the Consumer Secret

Step 5 — Pre-authorize and set the Run As user

This is the step most often missed, and the connection cannot work without it. External Client Apps authorize users by permission set, even when the user’s profile already has full access. Without a Run As user, Salesforce also has no identity to run the queries as, and token requests fail.

5a. Create and assign a permission set

1. Setup → Permission Sets → click the New button above the table (not the Create New View link, which builds a list view)
2. Label: e.g. Cast Integration
3. License: leave --None--, unless the Run As user holds a Salesforce Integration license — then choose Salesforce API Integration. A permission set whose license does not match the user’s cannot be assigned.
4. Save, then click Manage Assignments → Add Assignment
5. Select your Run As user, set Expires On to Never Expires, and Assign

Make sure the permission set or the user’s profile includes API Enabled under System Permissions.

5b. Attach it to the app and set the Run As user

1. Setup → External Client App Manager → your app → Policies tab → Edit
2. Expand OAuth Policies → Plugin Policies
3. Set Permitted Users to Admin approved users are pre-authorized and confirm the dialog
4. Click Save — the permission set selector does not appear until this is saved
5. Click Edit again, expand App Policies, and move your permission set from Available Permission Sets to Selected Permission Sets using the > arrow
6. In the Client Credentials Flow section, set Run As to your integration user
7. Under OAuth Policies → App Authorization, set:
   • IP Relaxation: Relax IP restrictions — Cast calls from Google Cloud, so its addresses are not in your trusted IP ranges
   • Refresh Token Policy: Refresh token is valid until revoked if offered. If your org enforces an idle limit instead, choose Expire refresh token if not used for specific time and set the maximum, e.g. 720 Day(s). Do not choose Immediately expire refresh token.
8. Save

💡 The permission set must be both assigned to the user and listed in the app’s Selected Permission Sets. With only one of the two, Cast reports user is not admin approved to access this app.

Step 6 — Configure the data source in Cast

Add a new data source and select Salesforce.

• Name (required): a descriptive name for this connection
• Authentication Method (required): OAuth 2.0 Client Credentials
• OAuth Consumer Key / Client ID (required): from Step 4
• OAuth Consumer Secret (required): from Step 4
• My Domain (required): e.g. mycompany.my
• Salesforce API Version (optional)
• Click Add Configuration, then use Test Connection

Rotate the Consumer Secret on your normal schedule, and update the Cast data source when you do — the connection fails until it is updated.

---

Once your data source connects, continue to Creating a Salesforce Dataset. If Test Connection fails, see Troubleshooting.