Get client credentials

Salesforce is retiring SOAP API login(), the username, password, and security token sign-in the Field Nation connector uses today. The replacement is the OAuth 2.0 client credentials flow: the connector signs in with a client ID and client secret from an app in your Salesforce org, and Salesforce runs every request as an integration user you choose.

This page is for the Salesforce admin. When you finish, you'll have the three values the Field Nation connector needs to authenticate:

Before you start

• Salesforce System Administrator access, or a user with the Create, edit, and delete External Client Apps permission
• An integration user for the connector to run as. Use the dedicated integration user from Path B — Dedicated Integration User so the connector only has the access it needs.

Action items

Create an External Client App

1. In Salesforce, click the Gear Icon at the top right → Setup

2. In Quick Find on the left, type External Client App Manager and click External Client App Manager

3. Click New External Client App

4. Under Basic Information, fill in:

   Field	Value
   External Client App Name	Field Nation Integration
   API Name	Field_Nation_Integration (auto-populated from the name)
   Contact Email	A monitored service mailbox, e.g. fn-integration@acme.com
   Distribution State	Local

Configure OAuth settings

Stay on the same form. These settings control how the connector signs in and what it can do.

1. Expand API (Enable OAuth Settings) and select Enable OAuth
2. In Callback URL, enter https://login.salesforce.com/services/oauth2/success. Salesforce requires a value, but the client credentials flow never redirects to it. Don't use the Field Nation Trigger URL here.
3. Under OAuth Scopes, move Manage user data via APIs (api) from Available OAuth Scopes to Selected OAuth Scopes. The connector needs no other scopes.
4. Under Flow Enablement, select Enable Client Credentials Flow. Accept the security warning if Salesforce shows one. This is the flow the connector signs in with.
5. Under Security, leave Require secret for Web Server Flow and Require secret for Refresh Token Flow selected (the default). The connector doesn't use these flows, but keeping them on means no one can get a token from this app without the client secret.
6. Click Create

Set the Run As user

The client credentials flow has no interactive sign-in, so Salesforce needs to know which user to run requests as. Every record the connector creates or updates is attributed to this user, and the connector can only access what this user can access.

1. On the app's page, click the Policies tab, then click Edit
2. Expand OAuth Policies
3. Under OAuth Flows and External Client App Enhancements, select Enable Client Credentials Flow
4. In Run As (Username), enter the integration user's username, e.g. fn-integration@acme.com.prod
5. Click Save

Copy the client ID and client secret

Salesforce calls the client ID the Consumer Key and the client secret the Consumer Secret.

1. On the app's page, click the Settings tab
2. Expand OAuth Settings
3. Click Consumer Key and Secret
4. Complete the identity verification prompt sent to your email or authenticator app
5. Copy the Consumer Key (your Client ID) and Consumer Secret (your Client Secret)

Find your My Domain name

The client credentials flow only works against your org's My Domain URL. Salesforce rejects it on login.salesforce.com and test.salesforce.com. The connector builds this URL from the Instance Name and Instance Type fields, so you only need the My Domain name: the part before .my.salesforce.com or .sandbox.my.salesforce.com.

1. In Setup, type My Domain in Quick Find and click My Domain
2. Find the Current My Domain URL and copy the part before .my.salesforce.com or .sandbox.my.salesforce.com

Enter the credentials in Field Nation

1. In Field Nation, open the Salesforce connector's settings in the Integration UI

2. Fill in these fields:

   Field	Value
   Instance Name	Your My Domain name, e.g. acme--uat
   Instance Type	production or test, matching your org
   Client ID	The Consumer Key
   Client Secret	The Consumer Secret

3. Click Save to run the connection test (see Test connection)

Verify the switch

A passing connection test alone doesn't confirm the connector is using client credentials. Check both of these:

1. Run the inbound and outbound tests in Save and run end-to-end tests and confirm both show success in Event History
2. In Salesforce, open the Run As user's record and check Login History. Recent logins should list Field Nation Integration (your External Client App) as the application.

Rotate the client secret

Rotate the secret on a regular schedule, and immediately if it may have been exposed. Anyone holding the current secret can get an access token for your org.

1. In External Client App Manager, open the app → Settings tab → OAuth Settings → Consumer Key and Secret
2. Generate a new consumer secret. Salesforce lets you stage a new secret while the current one keeps working.
3. Enter the new consumer secret in the Field Nation Client Secret field and click Save. Confirm the connection test passes.
4. Back in Salesforce, revoke the old secret

Frequently asked questions

Next steps

• Save and run end-to-end tests: confirm work orders sync both ways after the switch
• Field Nation troubleshooting: resolve failed events in Event History
• Grant API permission: keep this permission in place until Login History shows client credentials sign-ins

Sources

• Salesforce Time: How to Migrate to OAuth Client Credentials Flow
• Salesforce: SOAP API login() Retirement & new Security Requirements