## Set up JWT bearer flow

URL: https://docs.atlan.com/apps/connectors/crm/salesforce/how-tos/oauth-jwt-bearer-setup

> Configure Salesforce for OAuth 2.0 JWT bearer authentication for Atlan.

:::warning Important
Atlan currently supports [Salesforce Sales Cloud](https://www.salesforce.com/eu/products/sales-cloud/) and [Financial Services Cloud](https://www.salesforce.com/in/financial-services/cloud/) (FSC).
:::

Atlan recommends using [OAuth 2.0 JWT bearer flow](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5&language=en_US) for secure server-to-server integration with Salesforce. This guide walks you through creating the connected app, uploading certificates, configuring policies, and preparing the integration user.

## Prerequisites

Before you begin, make sure you have:

* Salesforce administrator access
* Network connectivity between Atlan and your Salesforce instance
* [Created a server key and certificate](https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_key_and_cert.htm). Save the generated `server.crt` and `server.key` files securely. You need the `server.crt` file to upload to Salesforce and the `server.key` file to configure the connection in Atlan.

## Create custom profile

A custom profile defines the specific permissions and access levels for your integration user. You'll create this profile with the minimum necessary permissions for Atlan to crawl your Salesforce data securely.

1. From _Setup_, enter `Profiles` in _Quick Find_ and select **Profiles**.
2. Click **New Profile** and clone **Standard User**
3. Enter **Profile Name**, for example, `AtlanIntegrationProfile`
4. Click **Save**, then click **Edit**
5. Under _Connected App Access_, check your connected app
6. Under _Administrative / System Permissions_, select:
 * **API Enabled**
 * **View Roles and Role Hierarchy**
 - This automatically enables **View Setup and Configuration**, which is required to crawl `EntityDefinitions` object
 * **Run Reports** (optional - only if reports and dashboards need to be extracted)
 - **View Dashboards in Public Folders** (optional - only if you want to extract dashboards)
 - **View Reports in Public Folders** (optional - only if you want to extract reports)

 :::info Important
 **View Setup and Configuration** is critical for crawling core metadata. Without this permission, Atlan can't extract `EntityDefinitions`, which contain essential metadata for all Salesforce objects, fields, and org assets. For example, fields are defined by `FieldDefinition`, a child of `EntityDefinition`, which includes metadata such as data type, label, and API name.
 :::

7. Under _Standard Object Permissions_ and _Custom Object Permissions_, select **Read** and **View All**
 * **Read**: Required for Salesforce to make the object visible
 * **View All**: Provides permission to describe metadata wherever custom fields are used
8. Click **Save**

## Create integration user

Follow these steps to create a dedicated user account for Atlan integration and assign the custom profile.

1. From _Setup_, expand **Users** under _Administration_
2. Click **Users**
3. Click **New User**
4. Enter required fields: _First Name_, _Last Name_, _Username_, _Email_, _Nickname_
5. Set **User License**: **Salesforce**
6. Set **Profile**: custom profile created in the [Create custom profile](#create-custom-profile) section
7. Click **Save**

Integration user requires Salesforce license to crawl metadata in Atlan. If license is unavailable, check allowed license limit: [Salesforce user licenses](https://help.salesforce.com/s/articleView?id=sf.users_license_types_view.htm&type=5)

## Create connected app

A connected app enables Atlan to authenticate with Salesforce using OAuth 2.0. This section guides you through creating the app and configuring OAuth settings.

1. Log in to Salesforce.
2. Click **settings** **icon**, then click **Setup**.
3. In _Setup_, enter `App Manager` in _Quick Find_ and select **App Manager**.
4. Click **New Connected App**.
5. Under _Basic Information_, enter:
 * **Connected App Name**: `AtlanConnector`
 * _API Name_: automatically populated
 * **Contact Email**: your email
6. Under _API (Enable OAuth Settings)_:
 * Check **Enable OAuth Settings**
 * Enter _Callback URL_: your domain. For example,`https://localhost`
 * Add _Selected OAuth Scopes_:
 - **Access Lightning applications (lightning)**
 - **Manage user data via APIs (api)**
 - **Perform requests at any time (refresh_token, offline_access)**
 * Check **Use digital signatures**
 * Click **Choose File** and upload `server.crt`
7. Click **Save**, then **Continue**
8. On connected app page, click **Manage Consumer Details** and copy **Consumer Key** (`client_id`) and **Consumer Secret**
9. Before proceeding, wait approximately 10 minutes for connected app activation

### Edit policies

Configure OAuth policies to control who can access the connected app and from where. These settings provide secure access for Atlan's integration.

1. From _Setup_, enter `Manage Connected Apps` in _Quick Find_ and select **Manage Connected Apps**.
2. Locate your connected app and click **Edit Policies**.
3. Under _OAuth Policies_: 
 * Set **Permitted Users** to **Admin approved users are pre-authorized** 
 * Set **IP Relaxation** to **Relax IP restrictions** 
 * If needed, set **Refresh Token Policy** to **Refresh token is valid until revoked** 
4. Click **Save**

### Add server certificate

To add the server certificate (`server.crt`) file to the connected app:

1. From _Setup_, enter `app manager` in the _Quick Find_ box and select **App Manager**.
2. Locate your connected app, and then click the dropdown arrow and select **Edit**.
3. For _API Enable OAuth Settings_, check **Use digital signatures**. 
4. Click **Choose File** and upload the `server.crt` file.
5. Click **Save**.

### Assign profile

Assign the custom profile to the connected app so the integration user has the required permissions when accessing Salesforce.

1. Open connected app page
2. Scroll to _Manage Profile_
3. Select the custom profile created in the [Create custom profile](#create-custom-profile) section and click **Save**

## Troubleshooting

If you encounter issues with JWT Bearer authentication, see [Troubleshooting Salesforce Connectivity](https://docs.atlan.com/llms/connectors/salesforce/troubleshooting-salesforce-connectivity/llms.txt).

## Next steps

* [Crawl Salesforce](https://docs.atlan.com/llms/connectors/salesforce/crawl-salesforce/llms.txt): Configure and run your first crawl to discover Salesforce data and metadata

---