Salesforce OAuth 2.0 Client Credentials Setup for HeavySet (Production Guide)

This guide explains how to configure a Salesforce External Client App for the OAuth 2.0 Client Credentials flow and collect the values HeavySet needs for production authentication: Client ID, Client Secret, and Token Endpoint URL.

---

What HeavySet needs

After setup, provide HeavySet with:

• Client ID — Salesforce Consumer Key
• Client Secret — Salesforce Consumer Secret
• Token URL — https://{your-domain}.my.salesforce.com/services/oauth2/token
• Grant Type — client_credentials

---

1. Enable External Client Apps

In Salesforce, go to:

Setup → Mange Users→ Profiles

Select a profile linked to your User, click Edit.

Enable "Created, edit, and delete External Client Apps" and click save.

---

1b. Enable org-level OAuth settings

In Salesforce, go to:

Setup → Identity → OAuth and OpenID Connect Settings

Enable:

• Allow OAuth User-Agent Flows
• Allow Authorization Code and Credentials Flows (if this setting is available in your org)

Click Save

In some Salesforce orgs, enabling Allow Authorization Code and Credentials Flows may be required before External Client App OAuth flows can be configured successfully.

---

2. Create the External Client App

You must be in Lightning Experience.

Go to:

Setup → Platform Tools → Apps → External Client Apps → External Client App Manager

If you do not see External Client Apps, ensure your org is on the latest Salesforce framework and the feature is enabled.

Click New External Client App

---

Basic information

• External Client App Name: HeavySet Integration (Client Credentials)
• API Name: HeavySet_Integration_CC
• Contact Email: your email
• Distribution State: Local

---

3. Select the Run As User (Admin Required)

The Client Credentials flow requires a Run As user.

⚠️ You must select a System Administrator user as the Run As user.

You can use:

• ✅ An existing System Administrator user (recommended for fastest setup)
• OR
• A dedicated integration user (optional, not required)

This user determines what data HeavySet can access via the API.

---

OAuth settings

Enable:

• ✅ Enable OAuth

Set:

• Callback URL:
  https://admin.heavyset.tech/oauth/callback
  (Required by Salesforce but not used in Client Credentials flow)

---

OAuth scopes

Select:

• full
• refresh_token, offline_access
• api
• id, profile, email, address, phone

---

Flow enablement

• ✅ Enable Client Credentials Flow

---

Security settings

• ✅ Require secret for Web Server Flow
• ✅ Require secret for Refresh Token Flow
• ✅ Enable Refresh Token Rotation
• ❌ Uncheck PKCE

Click Create

---

4. Configure app policies (Critical)

After creation:

Go to:

External Client App → Policies → Edit

Set:

• ✅ Enable Client Credentials Flow
• ✅ Run As User: select your System Administrator user
• ✅ IP Relaxation: Relax IP restrictions

Click Save

Without IP relaxation, authentication requests may fail due to IP enforcement.

---

5. Retrieve the credentials

Go to:

Settings → OAuth Settings

Copy:

• Consumer Key → Client ID
• Consumer Secret → Client Secret

---

6. Determine the token endpoint

Go to:

Setup → My Domain

Use:

https://{your-domain}.my.salesforce.com/services/oauth2/token

⚠️ Always use your My Domain URL, not login.salesforce.com

---

7. Final values for HeavySet

Field	Value
Client ID	Consumer Key
Client Secret	Consumer Secret
Token URL	https://{your-domain}.my.salesforce.com/services/oauth2/token
Grant Type	client_credentials

---

8. Test authentication

curl https://{your-domain}.my.salesforce.com/services/oauth2/token \
  -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

---

9. Common errors and fixes

invalid_client

• Recopy Client ID / Secret
• Ensure correct app

---

IP restriction errors / blocked request

• Set IP Relaxation → Relax IP restrictions

---

unauthorized_client

• Ensure Client Credentials Flow is enabled
• Check both app config and Policies

---

No data / permission issues

• Ensure Run As user is a System Administrator

---

External Client App not visible

• Use Lightning Experience
• Confirm feature is enabled in org

---

Summary

To successfully connect Salesforce to HeavySet:

• Use a System Administrator as Run As user (existing user is fine)
• Enable Client Credentials Flow
• Set IP Relaxation → Relax IP restrictions
• Use My Domain token URL
• Provide Client ID + Client Secret

These are the exact requirements for a working production integration.