Authenticating with Salesforce Using OAuth

If you're building a SaaS product that integrates with Salesforce, you'll need a secure way to authenticate into your customer's Salesforce instance. Salesforce uses OAuth 2.0 for authorization, similar to other platforms—but it has some unique requirements that are important to understand.

This guide walks through how OAuth authentication works in Salesforce, specifically for external client apps (like yours), and how our platform packages this setup for you inside your managed package.

What Is an External Client App in Salesforce?

An external client app is any application that needs to connect to a customer’s Salesforce org on their behalf. Your app might want to:

• Pull data from Salesforce (like Contacts or Opportunities)

• Push data into Salesforce (like activity logs or product usage)

• Trigger automations (like renewal alerts)

To do this securely, Salesforce requires a formal registration of your app, so users can authorize it via OAuth. Salesforce refers to this registration as a Connected App, but for clarity, we’ll just call it your external client app.

How OAuth Works in Salesforce (High Level)

Salesforce follows standard OAuth 2.0 flows. Here’s what happens:

1. A user from your customer’s Salesforce org clicks "Connect to Salesforce" in your product.

2. They are redirected to Salesforce’s login page.

3. After logging in, Salesforce asks them to grant access to your app.

4. Once approved, Salesforce redirects them back to your product with an authorization code.

5. Your app exchanges that code for access tokens.

6. Now your app can make authenticated API calls to Salesforce on their behalf.

Why You Don’t Have to Worry About Registering the App

Normally, Salesforce requires every developer to manually register their external client app in every customer’s org. But that’s a headache—and not scalable.

That’s where our platform helps.

We generate and package a pre-configured external client app for you as part of your managed package. This means:

• Your app’s OAuth configuration is already embedded when customers install your package.

• No manual setup required by them—or you.

• Everything is namespaced, secure, and upgradeable.

We take care of all the heavy lifting—secure key management, callback URLs, scopes, and token handling.

How This Works in a Managed Package

Your external client app is bundled inside the managed package we help you build. This includes:

• OAuth client credentials scoped to your app

• Proper OAuth scopes like refresh_token, api, full

• Automatic inclusion in the customer’s org at install time

When a customer installs your package:

• The external client app is automatically registered in their org.

• You can immediately initiate the OAuth flow.

• The customer doesn’t need to configure anything.

This makes your product:

• Easier to adopt

• Faster to activate

• Safer and more secure

Supported OAuth Flows

We primarily support two flows:

1. Authorization Code Flow

Use this when your users log in to your UI and connect Salesforce manually.

2. JWT Bearer Flow (Advanced)

Used for server-to-server integrations without user interaction—after initial authorization.

Summary

OAuth is required for any secure integration with Salesforce, but it doesn’t have to be hard. Our platform packages a pre-configured external client app directly into your managed package, so your users can connect in just a few clicks—no custom configuration, no friction.

This means faster onboarding, smoother renewals, and a native Salesforce experience for your customers.

If you're ready to build your integration, we'll generate everything you need to authenticate with Salesforce out of the box.