Creating an External Client App

External Client Apps are required by Salesforce because they provide robust security for your Salesforce environment and its applications. This is required for all Salesforce partner applications. If you are setting up your first Vicasso app, this article is for you. If you already have an External Client App for any Vicasso application, it is recommended to use it for all Vicasso applications. To migrate a Connected App to an External Client App, see: https://help.salesforce.com/s/articleView?id=xcloud.migrate_connected_app_to_external_client_app.htm

Jun 17, 2026
Knowledge

Permalink

https://kb.vicasso.com/?kb=000005393

Details

Requirements

The System Administrator profile, or another profile with Customize Application, Manage Certificates, and Modify Metadata Through API Functions permissions. Permission Sets do not work correctly with External Client Apps as of Feb 12, 2026.
The relevant Vicasso admin permission sets: Simple Survey Administrator, Case Flags Admin, E2CP Admin, Case Merge Admin.

Video Instructions (Written Instructions Below)

Written Instructions (or Follow Video Instructions above)

Step 1: Creating and Downloading a Self-Signed Certificate

1) Navigate to Salesforce Setup | Security | Certificate and Key Management

2) Click Create Self-Signed Certificate

3) Values:

Label: "Vicasso Apps"
Unique Name: "Vicasso_Apps"
Exportable Private Key = True
Key Size = 4096

Save

4) Click Download Certificate and save it for the next step.

Step 2: Creating an External Client App

1) Navigate to Salesforce Setup | Apps | External Client Apps | External Client App Manager

Click "New External Client App"
External Client App Name = "Vicasso Apps"
API Name = "Vicasso_Apps"
Contact Email = [Your Email]
(No other input in Basic Information is required)
Expand "API (Enable OAuth Settings)
Enable OAuth = True
Callback URL = https://test.salesforce.com (or any URL you like to satisfy required input, this is not used)
Selected OAuth Scopes = "Manage user data via APIs (api)" + "Perform requests at any time (refresh_token_offline_access)
Enable JWT Bearer Flow = True
Upload the certificate downloaded earlier.
Ensure that "Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows" is checked in the "Security" section.
(Everything else stays as-is)

Click Create

2) Click Edit (in the "Policies" tab)

Start Page = "OAuth"

Expand "OAuth Policies" and change "Permitted Users" to "Admin approved users are pre-authorized".

OAuth Start URL = "https://test.salesforce.com" (or any URL you like to satisfy required input, this is not used)

Scroll back up to "App Policies", and add "System Administrator" to available profiles.

Warning: Selecting Permission Sets instead of or in addition to Profiles appears to be an option, but results in an error as of Feb 12, 2026. Hopefully Salesforce will correct this soon.

Click "Save"

3) Salesforce requires you to lock security controls for Partner Applications. See here.

Click the "Review Controls" in the " Review and lock security controls." banner displayed at the top of the page.

Toggle to lock Security Controls, and confirm.

Step 3: Select the External Client App in Vicasso Setup

Go to the Vicasso setup wizard, locate the "Configure External Client or Connected App" setting, choose "Vicasso Apps"

Save Settings

Note: If you already have an External Client App (ECA) configured in your org, you may see the "Review and lock security controls." banner at the top of the page when viewing your ECA. More information here.

Click the "Review Controls" link, toggle to lock Security Controls, and confirm.

Title

Creating an External Client App

URL Name

Creating-an-External-Client-App

Creating an External Client App

Information