Set Up an External Client App for Salesforce Service Cloud

Create an External Client App (ECA) to provide Point of Sale access to Salesforce APIs for clienteling purposes. As of Spring '26, new merchants must use External Client Apps instead of Connected Apps.

Point of Sale needs the following credentials to access the Salesforce portal:

• URL: Salesforce instance URL
• Username
• Password
• Client ID (Consumer Key) of the External Client App
• Client Secret (Consumer Secret) of the External Client App

Refer to POS Access List - URLs and IP Addresses for a list of URLs and IP addresses to be allowlisted. This is to enable the necessary communication.

Important As of Spring '26, new connected apps can no longer be created. New merchants must create an External Client App instead. If you already have a connected app, you can continue using it. See Set Up the Connected App for Salesforce Service Cloud for instructions on using existing connected apps.

1. Work with your Salesforce admin team to create an External Client App that supports the Client Credentials OAuth flow.
   

   Note Refer to External Client Apps in Salesforce Help.
2. Log in to your Salesforce org.
   Log in at login.salesforce.com or at your My Domain URL, if set up by your administrator.
3. In Setup, go to Quick Find | External Client App Manager.
4. Click New External Client App.
5. In the Basic Information section, complete the required fields.
   • App Name
   • API Name
   • Contact Email
   • Description (optional)
6. Under API (Enable OAuth Settings), select Enable OAuth.
7. For the Callback URL, enter a valid callback URL.
   For testing purposes, you can use https://login.salesforce.com/services/oauth2/success.
8. In the Selected OAuth Scopes section, add the following scope:
   • Manage user data via APIs (api)

   

   Important

   OAuth Scope Requirements:

   • Do NOT add full (Access and manage your data) — This scope breaks the client credentials flow.
   • Do NOT add refresh_token (Perform requests at any time) — This scope is not applicable for client credentials flow.
9. Select Enable Client Credentials Flow.
   This is required for Point of Sale authentication.
10. Click Save or Create.
11. After the External Client App is created, copy the Consumer Key and Consumer Secret.
    You need these values to configure Point of Sale.
12. Navigate back to External Client App Manager and click your app name.
13. Click Edit Policies.
14. Under Client Credentials Flow, search for and select a Run As user.
    This is the integration user that Point of Sale will use to access Salesforce APIs. The selected user must have appropriate permissions to access the required Salesforce objects (Account, Notes, etc.).
15. Configure IP Relaxation settings as needed for your organization's security requirements.
16. Click Save.
17. In the Quick Find box, search for OAuth and select OAuth and OpenID Connect Settings.
18. Verify that Allow OAuth Username-Password Flows is enabled.
    This setting may be required depending on your authentication flow requirements.
19. Create a new Salesforce user or use an existing integration user to provide access to your External Client App.
20. Share the following credentials with Point of Sale:
    • Salesforce instance URL
    • Username and password of the integration user
    • Consumer Key (Client ID)
    • Consumer Secret

Testing the External Client App

Point of Sale uses the following curl command to obtain an access token and access Salesforce APIs:

curl -i -L -X POST \
  -H "Content-Type:application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CONSUMER_KEY" \
  -d "client_secret=YOUR_CONSUMER_SECRET" \
  'https://YOUR_INSTANCE.salesforce.com/services/oauth2/token'

Replace YOUR_CONSUMER_KEY, YOUR_CONSUMER_SECRET, and YOUR_INSTANCE with your actual values.

Note The client credentials flow uses grant_type=client_credentials and does not require username and password in the token request.