Create a Secure Connection with an External Client App

Use a Salesforce external client app to create a secure connection from Data Loader to your Salesforce org.

Before You Begin

These instructions are for Data Loader version 64.0.2 or later.

Before configuring Data Loader, create an external client app with OAuth enabled. See Configure the External Client OAuth Settings.

Configure the app with these settings:

Use the callback URL http://localhost:7171/OauthRedirect. If you choose a different port number, be sure to note it.
Select Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows to require Proof Key for Code Exchange.
Deselect Require secret for Web Server Flow to avoid storing the Consumer Secret in Data Loader.
For OAuth scopes, select Perform requests at any time (refresh_token, offline_access) and Manage user data via APIs (api).

After you create the client app, use it to get the information you need to configure Data Loader.

From Setup, in the Quick Find box, enter external client, and then select External Client App Manager.
Select the external client app you created, then select the Settings tab.
In the OAuth Settings section, click Consumer Key and Secret.

This opens the Consumer Details page.
In Data Loader, select Settings | Settings.
In Authentication host domain URL for Production, enter your org’s base URL.

The base My Domain URL has the format https://mycompany.my.salesforce.com. For a sandbox org, enter the sandbox URL in Authentication host domain URL for Sandbox.
In the Consumer Details page, copy the Consumer Key.
- Paste it into External Client App Consumer Key (Production) for a production org.
- Paste it into External Client App Consumer Key (Sandbox) for a sandbox org.
Leave the External Client App Consumer Secret fields empty.
If you specified a port other than 7171 for the external client app’s callback URL, enter that port number in OAuth PKCE callback port.
Click OK.

Data Loader can now use OAuth 2.0 Web Server Flow to authenticate when logging into a Salesforce org.
From Setup, in the Quick Find box, enter OAuth and select Connected Apps OAuth Usage to view a list of apps with OAuth access.
Click Block to block the Dataloader Partner and Dataloader Bulk connected apps.