# Prerequisite 1 - Create an External Client App

Create an external client app to enable OAuth authentication and API access for Data 360 Document AI, and facilitate the integration with Salesforce.
Learn more about [External Client Apps and Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.external_integrations.htm\&type=5).

## 1. Create a New External Client App

1. Go to **Setup**.
2. In the **Quick Find** search bar, find and select **External Client App Manager**.
3. Click **New External Client App**, and add the required information and add the required information in the New External Client App Manager as described in the following instructions.

### Basic Information

1. Under **Basic Information**, enter a descriptive **App Name**.
2. Enter your **Contact Email** address.

### API (Enable OAuth Settings)

1. Under **API (Enable OAuth Settings)**, select **Enable OAuth**.
2. In the **Callback URL** field, enter the following callback URL: `https://oauth.pstmn.io/v1/callback`.
3. Under **Available OAuth Scopes**, select all available scopes and move them to **Selected OAuth Scopes**.
   ![OAuth Scopes](https://a.sfdcstatic.com/developer-website/sfdocs/data-ae/media/loan-agent-prereq-3alt.png)

### Enable Flows and Set Security

1. Under **Flow Enablement**, select **Enable client credentials flow**. When the confirmation appears, click **OK**.
2. Under **Security**, ensure these default settings are selected:
   - Require secret for Web Server Flow.
   - Require secret for Refresh Token Flow.
   - Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows.
3. To create the external client app, click **Create**.
   ![Security Settings](https://a.sfdcstatic.com/developer-website/sfdocs/data-ae/media/loan-agent-prereq-3-2.png)

## 2. Configure OAuth and Admin Policies for Your App

Your new app opens, or you can access it by going to **Setup** and then selecting **External Client App Manager** in the **Quick Find** search bar. Under the **Policies** tab, click **Edit** and apply the following configurations.

### OAuth Policies

Under **OAuth Policies**, from the **Permitted Users** dropdown, select **Admin approved users are pre-authorized**, and click **OK** when the confirmation popup appears.

### App Policies

The **App Policies** section opens. Under **Select Profiles**, add **System Administrator** to the **Selected Profiles** list.

### Admin Policies

1. Scroll down to **OAuth Flows and External Client App Enhancements**, and select **Enable Client Credentials Flow**.
2. In the **Run As (Username)** field, enter the System Administrator's email address, as explained below.
3. Click **Save** to apply all changes.

:::Tip
**How to Enter the Admin Email Address:**

1. Open **Setup** in a new tab.
2. In the **Quick Find** search bar, find and select **Users**.
3. Identify the admin user and copy their email address.
4. Paste this email in the **Run As** field on the previous **Manage External Client Apps** tab.
:::

## 3. Retrieve the Consumer Key and Secret for Your App

1. Open your newly created app (under **External Client App Manager** on the **Quick Find** menu).
2. Under **OAuth Settings**, click on the **Consumer Key and Secret** button.
3. You may be prompted to provide a verification code via your registered email. Check your email for the code and enter it when prompted.
4. Save the **Consumer Key and Consumer Secret** securely for later steps in the implementation.

## Next Step

[Prerequisite 2 - Retrieve Your Salesforce Domain URL](/docs/ai/loan-agent/guide/aes-retrieve-sf-domain-url.md)