> For the complete documentation index, see [llms.txt](https://docs.work-relay.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.work-relay.com/administration/deployment/configuration/how-to-configure-the-salesforce-external-client-app-for-work-relay-deployment.md).

# How to configure the Salesforce external client app for Work-Relay deployment

Starting Release 8.2:

New in Release 8.0, Work-Relay deployment uses the Salesforce External Client App authentication mechanism, rather than direct username and password+token authorization. External Client App authentication is a secure connection and authentication mechanism between Salesforce organizations, as it doesn’t require storing target Salesforce org credentials in a Salesforce Source Org.

{% hint style="info" %}
The following actions should be performed in the Target Organization.
{% endhint %}

The following information is required in order to configure deployment settings:

* Organization Name - A user-defined name that identifies the Target Organization. (1)
* Domain URL - The URL of the Target Organization. This value can be quickly located by clicking the Profile icon and copying the value beneath your name (2). Remember to add "https\://" at the beginning.
* Client Key (3) and Client Secret (4) - These values should be obtained once from Target Organization via the Work-Relay **External Client App**, as described below.

![](/files/46f15c40a417bb28d6c55ae088a2621003337dde)

To create the Key and Secret, the following actions must be performed by the Target Organization admin:

* Add and configure the **External Client App**

## Configure external client app

In the Target Organization (to which Work-Relay components will be deployed), perform the following actions:

{% stepper %}
{% step %}

### Navigate to external client app manager

Navigate to Setup and go to **External Client App Manager.**
{% endstep %}

{% step %}

### Create an external client app

Click the **New External Client App** button.
{% endstep %}

{% step %}

### Set the properties

*Basic Information*

* External Client App Name = `Work-Relay Connect`
* API Name = `Work_Relay_Connect`
* Contact Email = *(email address of responsible person)*

*OAuth Settings*

* Enable OAuth Settings = true
* Callback URL (choose the appropriate value, depending upon org type):
  * Production - `https://login.salesforce.com/services/oauth2/callback`
  * Sandbox - `https://test.salesforce.com/services/oauth2/callback`
* Selected OAuth Scopes = `Manage user data via APIs (api)`\
  `Perform requests at any time (refresh_token, offline_access)`
* Enable Client Credentials Flow = true
* Require secret for Web Server Flow = true
* Require secret for Refresh Token Flow = true
* Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows = true
  {% endstep %}

{% step %}

### Save the external client app

Leave other properties set to their defaults and save the External Client App.
{% endstep %}

{% step %}

### Configure policies

After saving the External Client App, switch to Policies tab, and in OAuth Policies -> OAuth Flows and External Client App Enhancements, modify the following settings:

* Enable Client Credentials Flow = true
* set Run As. This is the User that will be used to perform deployments. "Run As" user should have System Administrator Profile.
* Leave other properties set to their defaults and save the External Client App.
  {% endstep %}
  {% endstepper %}

## Retrieve the client key and client secret

{% stepper %}
{% step %}

### Access the consumer key and secret

In **Settings** tab, **OAuth Settings** section, click Consumer Key and Secret button.
{% endstep %}

{% step %}

### Verify your identity

You will be asked to provide the Verification code which will be delivered to your user's email address. Copy-paste the code that was sent via email, and **Verify**.
{% endstep %}

{% step %}

### Copy the consumer key and consumer secret

You will be navigated to the **External Client App** screen with **Consumer Key** and   **Secret**.
{% endstep %}
{% endstepper %}

This Consumer Key and Consumer Secret must then be entered in the [Target Organization Configuration](/administration/deployment/deployment/deploying-using-connected-app-authentication.md) as "Client Key" and "Client Secret", in order to be used for future Work-Relay Deployments.