Creating Salesforce External Client Apps

You can create a Salesforce External Client app and configure an instance with OneTrust credentials to assist with Data Discovery operations. For additional details on building integrations with external client apps, click here.

For more information on our Salesforce Connector, click here.

To create a new external client app

  1. In Salesforce, click the Gear icon in the upper-right corner and select Setup.
  2. In the sidebar under Platform Tools, select Apps > External Client Apps.
  3. Click New External Client App.
  4. Complete the required fields under Basic Information.


  5. Configure the following options for API (Enable OAuth Settings):




    Option

    Description

    OAuth Settings

    • Select Enable OAuth

    • Callback URL format

      CODE 
      https://<OneTrust Environment FQDN>/integrationmanager/api/v1/tokens/callback

Example: https://app.onetrust.com

    OAuth Scopes

    Move the following to Selected OAuth Scopes:

    • Full Access ( full )

    • Manage user data via APIs ( api )

    • Perform requests any time ( refresh_token, offline_access)

    Flow Enablement

    Select Enable Client Credentials Flow only.

    Security

    Optional, no required options.
  6. Click the Create button.

To configure external client app

  1. In Salesforce, click the Gear icon in the upper-right corner and select Setup.
  2. In the sidebar under Platform Tools, select Apps > External Client Apps > External Client App Manager.
  3. Select your created app.
  4. In the Settings tab, expand the OAuth Settings section to click the Consumer Key and Secret button.


  5. Copy the following to use when configuring the worker node vault credentials:
    Consumer Key

    (client_id)

    Consumer Secret

    (client_secret)

  6. Click Edit, then go to Policies and expand the OAuth Policies.
  7. Under OAuth Flows and External Client App Enhancements, configure the following:


    Option

    Description

    Enable Client Credentials Flow

    Enable this option.

    Run As (Username)

    Specify the user who will perform actions on Salesforce.

    Important:

    The user must have the “API Enabled” system permission (via Profile or Permission Set). Without this, token generation or API calls will fail.
  8. Click the Save button.

To add credentials to worker node vault