---
title: "Create an external client app"
slug: "connect-an-external-client-app"
description: "Create an external client app to connect your Fullcast instance to Salesforce."
updated: 2026-08-13T20:27:48Z
published: 2026-08-13T20:27:48Z
canonical: "support.fullcast.com/connect-an-external-client-app"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fullcast.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an external client app

When you newly provision a tenant, you must add Fullcast to Salesforce as an external client app to import and export data between your Fullcast instance and Salesforce.

> [!NOTE]
> **Note**
> 
> - For all new connections—the external client app is required. Connected app will no longer be supported for new connections.
> - Existing connections with the connected app will continue to be supported, however it is recommended to migrate to the external client app as soon as possible.
> - If an existing connection is broken for reasons like sandbox refresh or credential changes, you will be required to migrate to the external client app.

## Create the external client app and enable OAuth

> [!NOTE]
> Note
> 
> Only complete the fields and options indicated. Any fields or options that are not listed, do not change.

1. In Salesforce, click the **Setup** menu and select **Setup**.

![Setup menu location.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image(318).png)
2. In the Quick find box, type `External Client App Manager` .

![Setup page displaying External Client App Manager with app details and contact email.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image(705).png)
3. Click **New External Client App**.
4. Under the **Basic Information** section, complete the following fields:

**External Client App Name**: Fullcast

**API Name:** Fullcast

**Contact Email:** Your email address.

**Distribution State:** Local

![Form fields for Basic Information including app name, email, and distribution state.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image(706).png)
5. In the **API** **(Enable OAuth Settings)** section, select the **Enable OAuth** checkbox.

![Settings for enabling OAuth in API configuration with checkbox option.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image(707).png)
6. Under **App Settings**, complete the following fields:

![Salesforce setup page showing OAuth scopes and external app settings for integration.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image-1786645370607.png)
  1. **Callback URL**: Copy and paste all three URLs based on the instance you are using

> [!NOTE]
> Note
> 
> The start of each URL should match the Fullcast site (Production or Pre-production) URL you will authenticate.

**Production site URLs:**

`https://app.fullcast.io/app/motion/segments`

`https://app.fullcast.io/app/admin/motion`

`https://app.fullcast.io/app/admin/export-import`

**Pre-production site URLs:**

`https://sandbox.fullcast.io/app/motion/segments`

`https://sandbox.fullcast.io/app/admin/motion`

`https://sandbox.fullcast.io/app/admin/export-import`
  2. **OAuth Scopes:** Move the following options from **Available OAuth Scopes** to **Selected OAuth Scopes**:
    - **Access the identity URL service (id, profile, email, address, phone)**
    - **Manage user data via APIs (api)**
    - **Manage user data via Web browsers (web)**
    - **Full access (full)**
    - **Perform requests at any time (refresh_token, offline_access)**
  1. **Flow Enablement:** Select the checkboxes for:
    - **Enable Authorization and Credentials Flow**
    - **Require user credentials in the POST body for Authorization Code and Credentials Flow**

![Settings for enabling various authentication flows with one option selected.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image-1786645576531.png)
  2. **Security:** Select the checkboxes for:
    - **Require secret for Web Server Flow**
    - **Require secret for Refresh Token Flow**
    - **Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows**
    - **Enable Refresh Token Rotation**
    - **Limit Idle Refresh Token Time-to-Live (TTL) to 30 days**

![Security settings for token management, including refresh token rotation and expiration options.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image-1786648193643.png)

> [!NOTE]
> Note
> 
> - If you are using an authorization flow that is not supported by PKCE, such as SSO, leave the box unchecked.
> - **Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days** is required by Salesforce. Fullcast automatically refreshes the connection before the 30-day deadline for tenants with active syncs. If a tenant has had no activity for more than 30 consecutive days, the connection may need to be re-authorized in Fullcast by navigating to **Settings** > **Integrations**.
7. Click **Create** or **Save**.

## Update OAuth policies

1. Go to **Apps > External Client Apps > External Client App Manager**.
2. Find and select **Fullcast.**
3. Select the **Policies** tab.
4. Click **Edit**.

![](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image-1786652657560.png)
5. In the **App Policies** section, select the following:
  - In the **Start Page** dropdown, select **None**.
6. In the **OAuth Policies** section, complete the following sections and fields:
  1. **Plugin Policies** section:
    1. **Permitted Users:** All users may self-authorize
    2. Leave **OAuth Start URL** and **Apex Plugin Class** blank![OAuth Policies section showing permitted users and custom scopes for app configuration.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/image-1786651580441.png)
  2. **App Authorization** section:
    - **Refresh Token Policy (Idle Expiration Time Limit Enforced):** Select **Expire refresh token if not used for specific time**
    - **Refresh Token Validity Period:** `30`
    - **Refresh Token Validity Unit:** Select **Day(s)**
    - **IP Relaxation:** Select **Relax IP Restrictions**
    - **Session Timeout In Minutes:** Set this to at least the length of your longest import or export job, so the session does not expire mid-run. `300` (5 hours) is typically sufficient.

![App authorization settings with refresh token policy, IP relaxation, and session timeout options displayed.](https://cdn.document360.io/369efcf7-66f9-4f6b-9d45-9ca24a5b06cf/Images/Documentation/Screenshot%202026-08-13%20154352.png)
7. Do not change any other fields or options.
8. Click **Save**.

## Authorize the connection in Fullcast

After saving the Salesforce external client app configuration, complete the authorization in Fullcast. Depending on your setup, the authorization process may require two steps — complete both if prompted. Refer to [Connect Fullcast to Salesforce with external client app](/plan-and-pay/docs/connect-fullcast-to-salesforce-with-external-client-app)

## Related

- [Connect Fullcast to Salesforce with external client app](/connect-fullcast-to-salesforce-with-external-client-app.md)