Set up authentication and credentials

Updated Nov 7, 2026 · Based on web research, 2026-11-07

The Server-to-Server connector is a backend-to-backend integration: your service authenticates itself (there’s no human logging in) using a connected app — a Salesforce-side record that issues OAuth 2.0 credentials your backend uses to call Data Cloud.

Create the connected app

1. From Setup, open App Manager and create a New Connected App.
2. Give it a name and enable OAuth Settings.
3. Add the Data Cloud scopes your integration needs, then save.

Choose an OAuth flow

A Server-to-Server integration typically uses one of two OAuth 2.0 flows — pick based on how you can store secrets:

1. Client credentials flow — simplest; your backend sends a consumer key and consumer secret to get a token.
2. JWT bearer flow — your backend signs a request with a private key instead of sending a secret over the wire; use this if you can manage a certificate.

Generate credentials

1. For the client credentials flow, open the connected app and copy its consumer key and consumer secret.
2. For the JWT bearer flow, generate a digital certificate, upload it to the connected app, and keep the matching private key on your backend.
3. Store whichever credential you use in a secret manager or environment variables — never in source control.

Test a token request

1. Call your org’s OAuth token endpoint with the connected app’s credentials and the flow’s grant type.
2. Confirm the response returns an access_token and an instance_url.
3. Send that token as a Bearer header on your first Data Cloud API call.