Authenticate to the Models API

Before you call any Models API endpoint, whether generative or predictive, create a Salesforce app and generate a JSON Web Token (JWT). This authentication flow is shared across every REST-based Models API capability, so complete it once and reuse the resulting token for both generation and prediction requests.

This video walks through the org setup and token generation steps below.

Authenticate to the Models API

To securely communicate with Salesforce using the Models API, create an External Client App.

Create an external client app with OAuth and JWT enabled. Use these instructions to get set up: Create an External Client App.

When creating the app, include these settings.

1. Use these OAuth scopes.

   • Manage user data via APIs (api): Gives you access to user data.
   • Perform requests at any time (refresh_token, offline_access): Permits you to get an OAuth access token.
   • Access the Salesforce API Platform (sfap_api): Enables access to the Salesforce REST API platform.

   

2. Select these additional OAuth settings.

   • Enable Client Credentials Flow: Allows your app to exchange its client credentials for an access token.
   • Issue JWT Web Token (JWT)-based access tokens for named users: Allows app to issue tokens for named users.

   

3. After creating the app, ensure that the API caller has the correct client credentials and that the client can issue JWT-based access tokens.

   • Click the Policies tab for the app, and then click Edit.
   • Select the Enable Client Credentials Flow checkbox.
   • Specify the client user in the Run As field.
   • Select the Issue JSON Web Token (JWT)-based access tokens checkbox. By default, this token expires in 30 minutes. You can change this value to less than 30 minutes.

   

A JSON Web Token (JWT) is required for authorization.

1. From Setup, in the Quick Find box, enter External Client Apps, and then select External Client Apps Manager.

2. Select your app, and click the Settings tab.

3. Expand the OAuth Settings section.

4. Click the Consumer Key and Secret button, and copy your key and secret. You need these values to mint this token.

   Store your consumer secret in a secure location.

5. From Setup, in the Quick Find box, enter My Domain, and then select My Domain.

6. Copy the value shown in the Current My Domain URL field.

7. Request a JWT from Salesforce using a POST request, specifying the values for your domain, consumer key, and consumer secret. For example:

   If you receive an invalid_grant error with the description, request not supported on this domain, verify that the domain is the domain specified when you view My Domain in Setup.

8. Use the access_token value in this response for the Authorization header in your API requests. For example:

With a valid access token, call any Models API endpoint over REST.

• Access Models API with REST — generative endpoints for chat, embeddings, text, and feedback.
• Access Predictive Endpoints with REST — predictive endpoints for classification and regression.

• Access Models API with Apex — Apex classes handle authentication for you; no JWT setup required.
• Salesforce Help: External Client Apps
• Salesforce Help: Create an External Client App