Step 2: Generate an Access Token

  1. From Setup, in the Quick Find box, enter External Client App Manager, and then select the app you created.

  2. Click the Settings tab, and go to the OAuth Settings section.

  3. Click Consumer Key and Secret. A browser tab opens up for entering the verification code.

  4. In the new browser tab, verify your identity with the verification code sent to the email address of your Salesforce account.

  5. Copy the consumer key.

  6. Generate the Signed JSON Web Token. You can use your preferred method, such as JWT.io to generate a signed JWT.

    1. JWT Header: Set alg to the RS256 hash algorithm.

    2. JWT Payload: Set these claims:

      • iss: The consumer key of the connected app.
      • sub: The username of the Salesforce user account. You can click the Salesforce profile icon at top-right, and then click Settings, to find the username.
      • aud: The instance login URL. For example, for falcon environment, use https://login.test1.pc-rnd.salesforce.com/, and for local environment use https://localhost:6101/.
      • exp: The expiry date and time of the token in milliseconds since the Unix epoch. You can use an Epoch Converter available online to generate this value.

    3. Signature: Add public and private keys in PEM format, including the respective headers and footers from the server.crt and server.key files. Copy the verified signature.

  7. Generate the access token.

    To generate the access token, use a cURL command that includes the signed JWT and the OAuth authorization endpoint (OAUTH_AUTH_ENDPOINT), which is typically your instance URL followed by /services/oauth2/token (https://login.salesforce.com/services/oauth2/token or https://login.test1.pc-rnd.salesforce.com/services/oauth2/token for test1 environments).

The OAUTH_AUTH_ENDPOINT value should match the aud (audience) value in your JWT.

Also, instead of using login.salesforce.com, you can use the My Domain, Experience Cloud site, or test.salesforce.com (sandbox) domain in these endpoints. For hostname, use the My Domain, Experience Cloud site, or custom URL. All endpoints require secure HTTP (HTTPS).

In the cURL command, replace OAUTH_AUTH_ENDPOINT with the appropriate URL and JWT with the verified signature you obtained from JWT.io. Use your terminal to execute the command to generate the access token.

The resulting token is in the {orgId}!{token} format. Share this with your customers as the bearer token.

After you generate the access token, create a platform event and assign permissions.