VitePress

Appearance

Exercise 1: Set Up Secure Access to Salesforce ​

In this exercise, you'll set up your Salesforce org to allow AI clients to connect securely.

Step 1: Verify Your Email Address ​

TIP

Using your own Salesforce org? You can skip this step.

Salesforce will email you a verification code later in this exercise, so make sure your Salesforce user is associated with an email address you can access.

  1. In Salesforce, click the gear icon in the upper right of the screen and click Setup.

  2. Enter Users in the Quick Find box, then select Users.

  3. Click Edit next to your user.

  4. Check the Email field:

    • If the email address is already yours, click Cancel.
    • Otherwise, enter your email address and click Save. Go to your email inbox, open the email titled "Finish changing your Salesforce account's email address", and click the verification link to confirm the change.

Step 2: Create an External Client App ​

TIP

Participating in a hosted workshop? An External Client App has already been created for you. You can skip this step.

An External Client App (ECA) allows external applications, such as Claude, to securely connect to Salesforce using standard protocols like OAuth 2.0. It defines how the application authenticates, what access it can request, and the security policies that govern its use.

  1. From Setup, enter External Client in the Quick Find box, then select External Client App Manager.

  2. Click New External Client App.

  3. Under Basic Information, enter:

    FieldValue
    App NameWorkshop MCP Client
    API NameWorkshop_MCP_Client (automatically populated)
    Contact EmailYour email address
    Distribution StateLocal

  4. Expand API (Enable OAuth Settings) and configure OAuth as follows:

    1. Check Enable OAuth.

    2. Callback URL. Enter two URLs, one per line:

      txt
      https://claude.ai/api/mcp/auth_callback
https://aiforce-mcp-playground-lb-73274fdb9e2c.herokuapp.com/oauth/sf/callback

    3. Selected OAuth Scopes. Add the following OAuth scopes:

      • Perform requests at any time (refresh_token, offline_access)
      • Access Salesforce hosted MCP servers (mcp_api).

  5. Under Security, check Issue JSON Web Token (JWT)-based access tokens for named users. Leave the other security settings unchanged.

  6. Double-check the information you entered, then click Create.

    Screenshot of the final External Client App configuration

TIP

Your External Client App may take up to 30 minutes to become available. You can continue with the workshop while Salesforce activates it. You'll need it in Exercise 2.

Step 3: Copy the Consumer Key and Secret ​

You'll need your External Client App's credentials to connect Claude or the AIforce Playground to your Salesforce org in the next exercise.

  1. From Setup, enter External Client in the Quick Find box, then select External Client App Manager.

  2. Select Workshop MCP Client.

  3. Click the Settings tab.

  4. Under OAuth Settings, click Consumer Key and Secret.

  5. Go to your email inbox and retrieve the verification code from Salesforce. Enter it on the Verify Your Identity screen.

  6. Copy the Consumer Key and Consumer Secret and paste them in a secure location. You'll use them to configure your AI assistant connection in the next exercise.

Summary ​

Your Salesforce org is now configured to allow secure connections from AI assistants.

Next, you'll connect Claude or the AIforce Playground to your org through the Headless 360 MCP Server.