## Set up client credentials flow

URL: https://docs.atlan.com/apps/connectors/crm/salesforce/how-tos/oauth-client-credentials-setup

> Configure Salesforce for OAuth 2.0 client credentials authentication in Atlan.

:::warning Important
Atlan currently supports [Salesforce Sales Cloud](https://www.salesforce.com/eu/products/sales-cloud/) and [Financial Services Cloud](https://www.salesforce.com/in/financial-services/cloud/) (FSC).
:::

Atlan supports the Salesforce [OAuth 2.0 client credentials](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_client_credentials_flow.htm&type=5&language=en_US) flow for server-to-server integration. This flow enables Atlan to authenticate using a dedicated integration user and an external client app in Salesforce, providing secure, non-interactive access to Salesforce metadata and data for crawling.

## Prerequisites

Before you begin, make sure you have:

* Salesforce administrator access
* Network connectivity between Atlan and your Salesforce instance

## Create custom profile

A custom profile defines the specific permissions and access levels for your integration user. You'll create this profile with the minimum necessary permissions for Atlan to crawl your Salesforce data securely.

Create a custom profile to manage permissions for the integration user:

1. From _Setup_, enter `profiles` in the _Quick Find_ box and select **Profiles**.
2. Click **New Profile**.
3. Select **Standard User** from the _Existing Profile_ dropdown to clone.
4. Enter a name, for example `AtlanIntegrationProfile`.
5. Click **Save**.
6. On the new profile page, click **Edit**.
7. Under _Connected App Access_, check the External Client App you create.
8. Under _Administrative / System Permissions_, uncheck all except:
 * **API Enabled**
 * **View Roles and Role Hierarchy**
 - This automatically enables **View Setup and Configuration**, which is required to crawl `EntityDefinitions` object
 * **Run Reports** (optional - only if reports and dashboards need to be extracted)
 - **View Dashboards in Public Folders** (optional - only if you want to extract dashboards)
 - **View Reports in Public Folders** (optional - only if you want to extract reports)

 :::info Important
 **View Setup and Configuration** is critical for crawling core metadata. Without this permission, Atlan can't extract `EntityDefinitions`, which contain essential metadata for all Salesforce objects, fields, and org assets. For example, fields are defined by `FieldDefinition`, a child of `EntityDefinition`, which includes metadata such as data type, label, and API name.
 :::

9. Under _Standard Object Permissions_ and _Custom Object Permissions_, select **Read** and **View All** for all items.
 * **Read**: Required for Salesforce to make the object visible
 * **View All**: Provides permission to describe metadata wherever custom fields are used
10. Click **Save**.

## Create integration user

The integration user acts as the identity that Atlan uses to connect to Salesforce. This dedicated user ensures secure, auditable access separate from individual user accounts.

Create a dedicated Salesforce user for the external client app:

1. From _Setup_, expand **Administration** → **Users** and click **Users**.
2. Click **New User**.
3. Enter required details: _First Name_, _Last Name_, _Username_, _Email_, _Nickname_.
4. Select **Salesforce** for _User License_.
5. Assign the custom profile created in the previous step.
6. Click **Save**.

## Create external client app

The external client app provides the OAuth infrastructure for secure server-to-server authentication. This app generates the credentials that Atlan uses to authenticate without requiring user interaction.

Set up the external client app for client credentials flow:

1. From _Setup_, enter `external client app manager` in _Quick Find_ and select **External Client App Manager**.
2. Click **New External Client App**.
3. Enter:
 * _External Client App Name_: for example, `AtlanIntegration`
 * _Contact Email_: your email
 * _Distribution State_: **Local**
4. Expand **API (Enable OAuth Settings)**:
 * Check **Enable OAuth**
 * Set _Callback URL_: `https://localhost` (placeholder, unused)
 * Move the following scopes to _Selected OAuth Scopes_:
 - **Manage user data via APIs (api)**
 - **Perform requests at any time (refresh_token, offline_access)**
 - **Access Lightning applications (lightning)**
5. Under **Flow Enablement**, check **Enable Client Credentials Flow**.
6. Enable:
 * **Require Secret for Web Server Flow**
 * **Require Secret for Refresh Token Flow**
7. Optional hardening:
 * Require Proof Key for Code Exchange (PKCE)
 * Enable Refresh Token Rotation
 * Issue JSON Web Token (JWT)-based access tokens
8. Click **Create**.
9. On the app details page, copy the **Consumer Key (Client ID)** and **Consumer Secret** from _OAuth Settings_.
10. Store these credentials securely—they're required to configure the Atlan connection.

### Configure policies

After creating the external client app, you need to configure its security policies. These policies control which users and profiles can access the app and define the authentication flow settings.

1. From **External Client App Manager**, locate your app and click **Edit**.
2. Open the **Policies** tab.
3. Set _Start Page_ to **None**.
4. Move the integration custom profile to _Selected Profiles_.
5. If using permission sets, move relevant sets to _Selected Permission Sets_.
6. In _OAuth Policies_, set:
 * _Permitted Users_: **Admin approved users are pre-authorized**
 * _OAuth Start URL_: leave blank unless required
7. In _OAuth Flows and External Client App Enhancements_:
 * Check **Enable Client Credentials Flow**
 * _Run As (Username)_: enter the integration user username
 * Set additional policies as required (IP Relaxation, Session Timeout, Refresh Token Policy)
8. Click **Save**.

## Troubleshooting

If you encounter issues with Client Credentials authentication, see [Troubleshooting Salesforce Connectivity](https://docs.atlan.com/llms/connectors/salesforce/troubleshooting-salesforce-connectivity/llms.txt).

## Next steps

* [Crawl Salesforce](https://docs.atlan.com/llms/connectors/salesforce/crawl-salesforce/llms.txt) to configure the connection in Atlan.

---