Connect Salesforce

This page is for the workspace admin who adds the connection and the Salesforce administrator who registers Nexatron in Salesforce. They can be the same person.

How it works

Nexatron never uses a shared Salesforce login. Each person signs in with their own Salesforce user, and every question runs as that user, so your org's field-level security, sharing rules, role hierarchy and territories decide what each person sees. Nexatron keeps each person's sign-in encrypted and refreshes it on its own.

Salesforce needs to know about Nexatron first. You do that by registering an External Client App in your org, which gives Nexatron a consumer key.

The order that works

The External Client App needs a callback URL, and that URL includes the Nexatron connection's id, which doesn't exist until the connection is saved. So save the connection first:

1. In Nexatron, go to Knowledge ▸ Sources and select New connection. Choose Salesforce, then:
   • Give the connection a name.
   • If this is a sandbox org, tick Sandbox org.
   • Enter your My Domain URL (Setup ▸ My Domain in Salesforce, for example https://acme.my.salesforce.com). It's required when the app's Distribution State is Local, which is the default.
   • Leave the consumer key empty for now, then select Continue and Connect.
2. Open the connection's page. Under "Connect your Salesforce account" it shows the exact redirect URL for this connection, with a copy button, and the OAuth scopes the app must allow.
3. In Salesforce, create the External Client App (next section), using that URL.
4. Back in Nexatron, in Sources, select the pencil beside the connection to edit it. Paste the consumer key (and the consumer secret, if the app requires one), then save.
5. Connect your own Salesforce account from the connection's page. Everyone else does the same under Your sign-ins on the Sources page.

Create the External Client App

In Salesforce, as an administrator:

1. From Setup, enter external client in the Quick Find box and select External Client App Manager.

2. Select New External Client App and fill in the basic information (a name such as "Nexatron", and a contact email).

3. Expand API (Enable OAuth Settings) and tick Enable OAuth.

4. In Callback URL, paste the redirect URL from the connection's page. If people open Nexatron at more than one address, put each address's URL on its own line.

5. In OAuth Scopes, add:

   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
   • Access MCP servers (mcp_api)

   If your workspace answers from Data 360, also add cdp_query_api.

6. Under Security:

   • Tick Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows. Nexatron always uses PKCE.
   • Require Secret for Web Server Flow is your choice. If you leave it on, add the consumer secret to the connection too. If you turn it off, the consumer key is enough.
   • Leave Issue JSON Web Token (JWT)-based access tokens for named users off. Nexatron doesn't need it.

7. Select Create. Salesforce can take up to 30 minutes to make a new app available. If the first sign-in says the app can't be found, wait and try again.

8. Open the app's Settings, then select Consumer Key and Secret under OAuth Settings. Salesforce may ask for a verification code sent to your email. Copy the consumer key, and the secret if you need it.

Who can sign in

By default any user in your org can authorize the app. To limit it, open the app's OAuth Policies and require a permission set, then assign that permission set to the people who should use Nexatron. Someone without it sees Salesforce refuse the sign-in.

Under OAuth Policies you can also shorten Refresh Token Validity and turn on refresh token rotation. Nexatron refreshes each person's sign-in on its own; once a refresh token expires, that person signs in again.

Sandboxes

A sandbox needs its own External Client App, created in the sandbox, and its own Nexatron connection with Sandbox org ticked and the sandbox's My Domain URL.

Troubleshooting

What you see	What to check
Salesforce says redirect_uri_mismatch	The app's Callback URL must match the connection's redirect URL exactly. Each connection has its own: copy it again from the connection's page.
Nexatron says it could not start the OAuth flow	The consumer key hasn't been added to the connection yet. Edit the connection in Sources and paste it.
Salesforce says the app can't be found, or the sign-in page is the generic login	Wait up to 30 minutes after creating the app. For an app whose Distribution State is Local, the connection needs your My Domain URL.
Salesforce refuses the sign-in for some people	The app's OAuth Policies may require a permission set those people don't have.
Nexatron says Salesforce did not grant Data 360 query access	Add the cdp_query_api scope to the app, then sign in again.