Create and Configure the External Client App (ECA) for the MCP Server

The External Client App (ECA) connects Claude to your org's MCP Server through OAuth. If you created a permission set, assign it to the ECA as part of this task.

1. From Setup, in the Quick Find box, enter External Client App Manager, and select External Client App Manager. Click New External Client App.
2. Under Basic Information, enter the app name (Salesforce - Beta), API name, and contact email.
3. Under API (Enable OAuth Settings), select Enable OAuth, set the callback URL to https://claude.ai/api/mcp/auth_callback, and select these OAuth scopes.
   • Access Salesforce hosted MCP servers (mcp_api)
   • Perform requests at any time (refresh_token, offline_access)
4. Create the ECA.
5. If you created a permission set, on the ECA's Policies tab, under App Authorization, click Edit, and add it. If you skipped that step, skip this step too.
6. Set Permitted Users to Admin approved users are pre-authorized.
   

   Important Don't select a self-authorization option: it skips the permission set gate and allows users access the ECA without explicit authorization.
7. If you created a permission set, select it to authorize those users. If you didn't create one, the ECA authorizes every user in the org.
8. If you created a permission set, assign it to the users who should have access. Otherwise, skip this step.
9. Under Settings > OAuth Settings > Security, select Issue JSON Web Token-based access tokens for named users.
10. From Settings, go to OAuth Settings and note the Consumer Key and Secret. You need them to connect the MCP client.