Skip to main content

​
Configure the Salesforce OAuth application

Complete this section once before users connect Salesforce accounts. You need Salesforce permission to create and manage External Client Apps.
1

Open External Client App Manager

In Salesforce Setup, enter App Manager in Quick Find, then open External Client Apps → External Client App Manager. Select New External Client App.Salesforce External Client App Manager with the New External Client App button
2

Enter the application information

Enter an application name, API name, and contact email. Keep Distribution State set to Local when the app is used only by this Salesforce organization.Salesforce New External Client App Basic Information form
3

Configure the callback URL and scopes

Expand API (Enable OAuth Settings) and select Enable OAuth. Enter this callback URL:
Move these permissions to Selected OAuth Scopes:
Salesforce External Client App OAuth settings with the Rollout callback URL and required API and refresh-token scopes selected
4

Enable the authorization flow

Under Flow Enablement, select Enable Authorization Code and Credentials Flow. Keep Salesforce’s required PKCE and refresh-token rotation settings enabled.Salesforce External Client App Flow Enablement with Authorization Code and Credentials Flow selected and PKCE enabled
5

Create the app and copy its OAuth credentials

Select Create. After Salesforce creates the app, open its Settings tab and select Consumer Key and Secret. Complete Salesforce identity verification, then copy the Consumer Key and Consumer Secret.Use the Consumer Key as SALESFORCE_CLIENT_ID and the Consumer Secret as SALESFORCE_CLIENT_SECRET in the Rollout deployment configuration. Treat the Consumer Secret like a password.
Salesforce documents these settings in its External Client App OAuth guide.

​
Connect a Salesforce account

End users do not need to copy an API key or security token. Authorization happens in a secure Salesforce OAuth window.
1

Choose the Salesforce environment

In the Salesforce connection window, select Prod for a production organization or Sandbox for a test organization, then select Connect Account.Rollout test tenant Salesforce connection form with the production and sandbox environment selector
2

Sign into the correct organization

Sign in with a Salesforce user that has access to the records you want to sync. Complete Salesforce verification if prompted.
3

Approve access

Review the requested permissions and select Allow. The secure window returns you to the product when the connection is complete.
The Salesforce user must have REST API access. If authorization succeeds but the connection is rejected, ask a Salesforce administrator to check the user’s edition, profile, and permission sets.