Salesforce: OAuth 2.0 JWT Bearer

Method 1: OAuth 2.0 JWT Bearer (recommended)

💡 This is one of three ways to connect Salesforce to Cast. See choosing an authentication method for a comparison, or go back to the Salesforce Data Source overview.

Cast signs a token with a private key, and Salesforce verifies it with a matching certificate you upload. Nothing interactive, and no password is shared.

What you will need

Item	Where it comes from
Integration Username	Setup → Users → Username field
OAuth Consumer Key	Your app → Settings → OAuth Settings
RSA private key file (PEM)	Generated with the certificate below

Step 1 — Choose the integration user

Every API call Cast makes runs as one Salesforce user, and that user’s permissions decide what Cast can read. Use a dedicated integration user rather than a personal account, so the connection survives staff changes.

The user must be active, API Enabled, and able to read the objects, fields and reports you want in Cast.

Go to Setup → Users, open the user, and copy the Username field.

💡 The Username field is not always the same as the user’s email address. Copy it exactly as Salesforce shows it.

Step 2 — Generate a certificate and private key

On a secure machine with OpenSSL (built into macOS and Linux; on Windows use Git Bash or WSL):

# Generate a 2048-bit RSA private key
openssl genrsa -out cast_salesforce.key 2048

# Create a matching self-signed certificate (valid 1 year)
openssl req -new -x509 -key cast_salesforce.key -out cast_salesforce.crt -days 365

This gives you two files:

• cast_salesforce.crt — upload to Salesforce in Step 3
• cast_salesforce.key — upload to Cast in Step 6

Salesforce requires RSA, 2048-bit or stronger. ECDSA keys are not accepted. Renew the certificate before it expires.

Step 3 — Create an External Client App

Salesforce is replacing Connected Apps with External Client Apps. In most orgs, Setup → App Manager now offers only New External Client App. If your org still shows New Connected App, see the Connected App notes below.

1. Setup → search External Client App Manager
2. Click New External Client App
3. Fill in Name, Contact Email, and set Distribution State to Local
4. Expand API (Enable OAuth Settings) and check Enable OAuth
5. Callback URL: https://login.salesforce.com/services/oauth2/callback (Salesforce requires a value; this flow never uses it)
6. Selected OAuth Scopes — add both:
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
7. Under Flow Enablement, check Enable JWT Bearer Flow and upload cast_salesforce.crt
8. Leave Issue JSON Web Token (JWT)-based access tokens for named users unchecked — despite the name, it is an unrelated feature that changes the access token format and can break API access
9. Click Create

💡 Greyed-out security settings are fine. Newer orgs lock on PKCE, Refresh Token Rotation and an idle token limit, showing “To change this required setting, contact Support.” You do not need a Support case. PKCE applies only to browser-based flows, and refresh token rotation only to flows that issue refresh tokens. JWT Bearer does neither.

Wait 2–10 minutes after creating the app. Salesforce needs time to propagate it, and tests run immediately after creation often fail for that reason alone.

Step 4 — Copy the Consumer Key

1. Setup → External Client App Manager → click your app’s name
2. Open the Settings tab → expand OAuth Settings
3. Click Consumer Key and Secret (you may need to verify your identity with a code emailed to the app’s contact address)
4. Copy the Consumer Key — Cast does not need the Consumer Secret for this method

While you are here, confirm Flow Enablement still shows JWT Bearer Flow with your certificate. If that section is empty, the upload did not save.

Step 5 — Pre-authorize the integration user

This is the step most often missed, and the connection cannot work without it. External Client Apps authorize users by permission set, even when the user’s profile already has full access.

5a. Create and assign a permission set

1. Setup → Permission Sets → click the New button above the table (not the Create New View link, which builds a list view)
2. Label: e.g. Cast Integration
3. License: leave --None--, unless the integration user holds a Salesforce Integration license — then choose Salesforce API Integration. A permission set whose license does not match the user’s cannot be assigned.
4. Save, then click Manage Assignments → Add Assignment
5. Select your integration user, set Expires On to Never Expires, and Assign

Make sure the permission set or the user’s profile includes API Enabled under System Permissions.

5b. Attach it to the app

1. Setup → External Client App Manager → your app → Policies tab → Edit
2. Expand OAuth Policies → Plugin Policies
3. Set Permitted Users to Admin approved users are pre-authorized and confirm the dialog
4. Click Save — the permission set selector does not appear until this is saved
5. Click Edit again, expand App Policies, and move your permission set from Available Permission Sets to Selected Permission Sets using the > arrow
6. Under OAuth Policies → App Authorization, set:
   • IP Relaxation: Relax IP restrictions — Cast calls from Google Cloud, so its addresses are not in your trusted IP ranges
   • Refresh Token Policy: Refresh token is valid until revoked if offered. If your org enforces an idle limit instead, choose Expire refresh token if not used for specific time and set the maximum, e.g. 720 Day(s). Do not choose Immediately expire refresh token.
7. Save

💡 The permission set must be both assigned to the user and listed in the app’s Selected Permission Sets. With only one of the two, Cast reports user is not admin approved to access this app.

Step 6 — Configure the data source in Cast

Add a new data source and select Salesforce.

• Name (required): a descriptive name for this connection
• Authentication Method (required): OAuth 2.0 JWT Bearer (recommended)
• Username (required): the integration user’s Username from Step 1
• OAuth Consumer Key / Client ID (required): from Step 4
• OAuth Private Key File (PEM) (required): upload cast_salesforce.key
• My Domain (optional): e.g. mycompany.my — Cast uses the standard Salesforce login host when this is empty
• Sandbox (optional): check only for a sandbox org. A Developer Edition org is production, not a sandbox.
• Salesforce API Version (optional)
• Click Add Configuration, then use Test Connection

Using a Connected App instead

If your org still offers Connected Apps, the same credentials work. The differences are:

• Check Use digital signatures and upload the .crt there, instead of Enable JWT Bearer Flow
• Copy the Consumer Key from Manage Consumer Details
• Set policies under Manage → Edit Policies
• Connected Apps can authorize by Profile as well as permission set, so Manage Profiles works instead of Step 5b

---

Once your data source connects, continue to Creating a Salesforce Dataset. If Test Connection fails, see Troubleshooting.