# Set up JDBC with External Client Apps

With the Data 360 Java Database Connectivity (JDBC) driver, you can access and retrieve data from Data 360 by using tools that support JDBC and Data 360 SQL. Use this document to learn about setting up and configuring the Data 360 JDBC driver with External Client Apps.

> **Important:** As of February 21, 2026, you can no longer create Connected Apps. Use External Client Apps (ECAs) instead. ECAs support the OAuth 2.0 JWT Bearer Flow for JDBC connections. Username-Password Flow and Refresh Token Flow are not supported with ECAs.

## Prerequisites

Before connecting to Data 360 with the JDBC driver:

- [Turn on Data 360](https://help.salesforce.com/s/articleView?id=data.c360\_a_setup_provision.htm\&type=5)
- [Configure Users, Admins, and Permission Sets](https://help.salesforce.com/s/articleView?id=data.c360\_a_setup_walkthrough.htm\&type=5)
- [Assign Data 360 Permission Sets](https://help.salesforce.com/s/articleView?id=data.c360\_a_setup_permission_sets.htm\&type=5)

**Required Permissions:**

- To create an External Client App and connect JDBC, see the user permissions table in [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm\&type=5).
- To use your External Client App in a non-default data space, associate the chosen permissions set with the data space. For more information, see Salesforce Help: [Associate a Permissions Set with a Data Space](https://help.salesforce.com/s/articleView?id=data.c360\_a_data_spaces_associate_perm_sets.htm\&type=5).

## Before You Begin: Generate a Key Pair and Certificate

Open a terminal or command prompt and run these commands:

```sh
# Create a private and public key pair
openssl genrsa -out keypair.key 2048

# Create a self-signed digital certificate (provide your country, state, and organization when prompted)
openssl req -new -x509 -nodes -sha256 -days 365 -key keypair.key -out certificate.crt

# Create a PKCS#8 private key (compatible with the JDBC driver)
openssl pkcs8 -topk8 -nocrypt -in keypair.key -out private.key
```

You now have three files, each used at a different point:

- `keypair.key`: The input for generating `certificate.crt` and `private.key`.
- `certificate.crt`: Upload this to the External Client App in Step 2.
- `private.key`: Provide this when you configure your JDBC connection. See [Driver URL and Properties](#driver-url-and-properties).

## Step 1: Create the External Client App

1. From Setup, enter `External Client App Manager` in the Quick Find box, then select **External Client App Manager** under **Apps → External Client Apps**.
2. Click **New External Client App**.
3. Fill in the required fields:

- **External Client App Name**: A display name for your app (for example, "Data 360 JDBC Connection")
- **API Name**: Auto-fills from the display name
- **Contact Email**: Your email address
- **Distribution State**: Leave as **Local**

4. Don't click Create yet. Continue to the next step to enable OAuth.

## Step 2: Enable OAuth and Configure JWT Bearer Flow

On the same form from Step 1:

1. Expand the **API (Enable OAuth Settings)** section.
2. Check **Enable OAuth**. The OAuth configuration fields appear.
3. Under **App Settings**:

- **Callback URL**: Enter any valid URL (for example, `http://localhost:55555`). The callback URL is required for JWT Bearer authentication, even though it isn't used at runtime.
- **OAuth Scopes**: In the **Available OAuth Scopes** list, click each of the following scopes, then click the right-arrow ▶ to move them to **Selected OAuth Scopes**:
  - `Manage user data via APIs (api)`
  - `Perform SQL queries on Data Cloud data (cdp_query_api)` — Scroll the Available list to find this scope.
  - `Perform requests at any time (refresh_token, offline_access)`

4. Under **Flow Enablement**, check **Enable JWT Bearer Flow**. A **Certificate Upload** widget appears directly below the checkbox.
5. In the **Certificate Upload** widget, click **Upload Files** and select the `certificate.crt` file you generated in [Before You Begin](#before-you-begin-generate-a-key-pair-and-certificate).

> **Note:** Upload only the `certificate.crt` file here. You'll use the `private.key` file later when configuring your JDBC connection.

6. Leave the **Security** defaults as-is (PKCE and Require secret are fine for JWT Bearer Flow).
7. Click **Save** at the bottom of the form.

After you save, you land on the External Client App detail page. Before you can use the app, you need to configure who can authorize it.

## Step 3: Configure OAuth Policies

After you save the External Client App, you configure which users are permitted to use it by editing the saved app.

1. In the External Client App. On the detail page, select the **Policies** tab, then click **Edit**.
2. Expand **OAuth Policies** if it isn't already expanded.
3. Under **Plugin Policies**, set **Permitted Users** to **"Admin approved users are pre-authorized"**.
4. After you change Permitted Users, additional fields appear for selecting profiles and permission sets. Under **Select Profiles**, choose the permitted profile *or*, under **Select Permission Sets**, choose the permitted permission set. Do not choose both.
5. Click **Save**.

## Step 4: Retrieve the Consumer Key

The Consumer Key (also called Client ID) is required for JDBC authentication.

1. Go back into your saved External Client App and open its OAuth settings.
2. Copy the **Consumer Key** value. You'll use this as the `clientId` property when connecting with the JDBC driver.

> **Note:** The Consumer Secret is not required for JWT Bearer Flow authentication. You need only the Consumer Key (`clientId`) from the app.

## Driver URL and Properties

Configure the driver by using a connection URL combined with Java properties. The URL format is `jdbc:salesforce-datacloud://<Salesforce Domain Name>`.

For the JWT Bearer Flow with External Client Apps, use the Salesforce login domain name: `jdbc:salesforce-datacloud://login.salesforce.com`. You can use `login.salesforce.com` instead of your organization-specific My Domain address (such as `mycompany.my.salesforce.com`).

During connection setup, provide these properties for JWT Bearer Flow authentication:

### Required Properties for JWT Bearer Flow

- `clientId`: Consumer Key from your External Client App
- `privateKey`: Contents of the private key file (`private.key`) in PEM format
- `userName`: Username for the account

> **Note:** The `clientSecret` (Consumer Secret) is not required for JWT Bearer Flow authentication.

### Optional Properties

- `dataspace`: Data Space for queries. Default: `default`.
- `maxRetries`: Number of authentication request retries. Default: `3`.
- `User-Agent`: This value identifies your application and can help Salesforce Support with debugging. It must be a valid product component as defined in RFC7231, including a version component. Format: `salesforce-datacloud-jdbc/version`.

## Next Steps

Now that you've configured your External Client App and have your Consumer Key and private key, you're ready to connect.

- [Use the JDBC driver with Java](/docs/data/data-cloud-query-guide/guide/jdbc-java.md)
- [Use the JDBC driver with DBeaver](/docs/data/data-cloud-query-guide/guide/jdbc-dbeaver.md)

> **Connecting from DBeaver?** In DBeaver, leave the password field blank and use only the username. You'll provide the `clientId` from your External Client App. The `clientSecret` is not needed for JWT Bearer Flow.

## See Also

- Salesforce Help: [OAuth 2.0 JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm\&type=5)
- Salesforce Help: [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm\&type=5)
- GitHub: [Data 360 JDBC Driver Repository](https://github.com/forcedotcom/datacloud-jdbc)