|
| 1 | +## Post-Installation Setup (takes ~3–5 minutes) |
| 2 | + |
| 3 | +To enable server-to-server authentication for your application using JWT Bearer Flow, follow these steps to manually create and configure a Connected App with a self-signed certificate. |
| 4 | + |
| 5 | +### Step 1 – Create the Connected App |
| 6 | +1. Go to **Setup → App Manager → New Connected App**. |
| 7 | +2. Fill in the basic info: |
| 8 | + - **Connected App Name**: `Flow Scanner JWT` |
| 9 | + - **API Name**: `Flow_Scanner_JWT` (auto-populates based on the name) |
| 10 | + - **Contact Email**: your email address |
| 11 | +3. Under **API (Enable OAuth Settings)**: |
| 12 | + - Check **Enable OAuth Settings** |
| 13 | + - **Callback URL**: `https://login.salesforce.com/services/oauth2/success` (placeholder; not used in JWT flow but required) |
| 14 | + - Check **Use digital signatures** |
| 15 | + - **Require Secret for Web Server Flow**: Uncheck (if visible)but we |
| 16 | + - **Require Secret for Refresh Token Flow**: Uncheck |
| 17 | + - **Enable Client Credential Flow**: Uncheck |
| 18 | + - **Enable Authorization Code Flow**: Uncheck |
| 19 | + - **Require PKCE**: Uncheck |
| 20 | + - **Enable Token Exchange Flow**: Uncheck |
| 21 | + - **Selected OAuth Scopes**: Add `Access and manage your data (api)` and `Perform requests on your behalf at any time (refresh_token, offline_access)` |
| 22 | + - Uncheck other options like **Enable Named User JWT Flow**, **Introspect All Tokens**, **Refresh Token Rotation**, **Secret Required for Token Exchange** |
| 23 | +4. Under **OAuth Policies**: |
| 24 | + - **IP Relaxation**: `Relax IP restrictions` |
| 25 | + - **Refresh Token Policy**: `Refresh token is valid until revoked` |
| 26 | +5. Click **Save** (it may take a few minutes for the app to be created). |
| 27 | + |
| 28 | +### Step 2 – Create & Upload the Certificate (45 seconds) |
| 29 | +1. Go to **Setup → Certificate and Key Management**. |
| 30 | +2. Click **Create Self-Signed Certificate**. |
| 31 | +3. Fill in: |
| 32 | + - **Label**: `Flow Scanner` |
| 33 | + - **Unique Name**: `Flow_Scanner` ← **must be exactly this** |
| 34 | + - Key Size: 2048 or higher |
| 35 | +4. Click **Save**. |
| 36 | +5. Download the certificate (`.crt` file). |
| 37 | +6. Go to **App Manager → Flow Scanner JWT → Manage → Edit**. |
| 38 | +7. Under **Use digital signatures**, click **Upload Certificate**. |
| 39 | +8. Upload the `.crt` file → **Save**. |
| 40 | + |
| 41 | +### Step 3 – Copy & Paste the Consumer Key (30 seconds) |
| 42 | +1. In **App Manager → Flow Scanner JWT → View**. |
| 43 | +2. Click **Manage Consumer Details** (verify identity once). |
| 44 | +3. **Copy the Consumer Key** (starts with `3MVG…`). |
| 45 | +4. Go to **Setup → Custom Metadata Types → Flow Scanner OAuth Config → Manage Records**. |
| 46 | +5. Edit (or create) the record with **Developer Name = `Default`**. |
| 47 | +6. Paste into the **Consumer Key** field → **Save**. |
| 48 | + |
| 49 | +### Step 4 – Pre-Authorize the Connected App (optional, to avoid consent screen) |
| 50 | +1. In **App Manager → Flow Scanner JWT → Manage → Edit Policies**. |
| 51 | +2. Set **Permitted Users** to **Admin approved users are pre-authorized** → **Save**. |
| 52 | +3. Scroll to **Profiles** section → **Manage Profiles**. |
| 53 | +4. Check **System Administrator** (or relevant profiles) → **Save**. |
| 54 | + - This allows users with those profiles to use the app without prompts. If you need more granularity, create a custom (unmanaged) Permission Set and assign it here instead. |
| 55 | + |
| 56 | +### Step 5 – Assign the Permission Set |
| 57 | +1. Go to **Setup → Permission Sets → Flow Scanner User**. |
| 58 | +2. Click **Manage Assignments** → add your users → **Done**. |
| 59 | + |
| 60 | +**The app is now ready to use!** Assigned users can run Flow Scanner features, and JWT authentication will handle Tooling API calls seamlessly. |
0 commit comments