How the Salesforce Connection Works
This page explains the connection you create in the Setup Guide. You do not need it to complete the setup, but it helps when you review the setup with your security team or troubleshoot it.
The JWT Bearer flow
aprity connects to your org with the OAuth 2.0 JWT Bearer flow. It uses a certificate instead of a password:
- aprity holds a private key. You never see it and it never leaves aprity.
- Your org holds the matching public certificate, uploaded to the External Client App you created.
- When an analysis runs, aprity signs a short-lived token with its private key, on behalf of your integration user. Salesforce checks the signature against the certificate and returns an access token.
No password is stored or sent, and no one has to sign in interactively for an analysis to run.
What each setup element is for
| Element | Where | Purpose |
|---|---|---|
Certificate (.crt) | Downloaded from the aprity Setup Wizard, uploaded to the External Client App | Lets Salesforce check that the connection request comes from aprity. |
External Client App aprity | Salesforce Setup | Authorizes aprity to call the Salesforce APIs. The same app is used for the web portal sign-in and for AI clients. |
| Consumer Key | Copied from the External Client App, pasted in the wizard | Tells Salesforce which app the connection request is for. |
| Integration user | Entered in the wizard | The Salesforce user aprity connects as. aprity reads metadata with this user's access. |
| Profile in Select Profiles | External Client App policies | Pre-authorizes the integration user, because nobody is there to approve a consent screen. |
| aprity Admin permission set | Assigned to the integration user | Gives the integration user access to the aprity components in your org. |
OAuth scopes api, refresh_token, offline_access | External Client App | Let aprity use the Salesforce APIs. |
OAuth scopes openid and identity URL | External Client App | Only needed for the web portal sign-in. |
What aprity reads
aprity reads the metadata of your org (its configuration: objects, fields, rules, automations, code, pages, permissions, integrations) to produce the documentation. It does not read your business records, and it does not modify your org's configuration.
Using an existing Connected App
Salesforce now steers administrators toward External Client Apps, and the Setup Guide describes that path. If your org already has a legacy Connected App for aprity, it works the same way as long as it has the equivalent settings:
- OAuth enabled, with the same callback URLs and scopes as in the Setup Guide.
- Use digital signatures checked, with the aprity certificate uploaded.
- For the web portal: no client secret required for the Web Server and Refresh Token flows, PKCE required.
- In Manage Connected Apps > aprity > Edit Policies: Permitted Users set to Admin approved users are pre-authorized, IP Relaxation set to Relax IP restrictions, and the integration user's profile added under Profiles.
Copy its Consumer Key (from Manage Consumer Details) and paste it in the aprity Setup Wizard like in the Setup Guide.
Certificate renewal
When the certificate has to be replaced, the new one is uploaded to the same External Client App; nothing else changes. See Certificate Rotation.