Configure Salesforce JWT for the Platform

Use Salesforce JWT (JSON Web Token) authentication to connect Titan to Salesforce without storing a Salesforce user’s password. Salesforce verifies a signed token against the certificate uploaded to your external client app and issues an access token for an authorized user.

Before You Begin

• Make sure Salesforce is already authenticated under Titan Dashboard > Settings > Integrations.
• Open Titan Dashboard and Salesforce in separate browser tabs.
• Make sure you can create an external client app and configure its policies in Salesforce.
• Have OpenSSL available to generate your private key and certificate.

Generate the Keys and Certificate

The commands below save the keys and certificate in the folder your terminal is currently using. Choose this folder first so you can find the files when configuring Salesforce and Titan.

Choose Where to Save the Files

1. Create a folder named TitanJWT on your computer.
2. Open Terminal on macOS/Linux or Git Bash on Windows.
   • Note: On Windows, install Git for Windows first if needed.
3. Type cd followed by a space, then drag the TitanJWT folder into the terminal window to insert its path. Press Enter.
4. Run the following command to check your location:

5. Confirm that the displayed path ends in TitanJWT, then run the commands for your operating system below.

macOS

Open Terminal and run the following commands.

1. Generate a private key:

openssl genrsa -out privatekey.pem 2048

2. Generate a public key from the private key:

openssl rsa -in privatekey.pem -pubout -out publickey.pem

3. Generate a self-signed certificate:

openssl req -new -x509 -key privatekey.pem -out server.cert -days 365

4. Running this command opens an interactive prompt (Country Name, State, Locality, Organization Name, Organizational Unit, Common Name, Email Address). These values are not validated by Salesforce and can be left blank except Country Name, which requires a 2 letter code (e.g. US).

Windows

Install Git for Windows and open Git Bash to run the OpenSSL commands.

1. Generate a private key:

openssl genrsa -out privatekey.pem 2048

2. Generate a public key from the private key:

openssl rsa -in privatekey.pem -pubout -out publickey.pem

3. Generate a self-signed certificate:

openssl req -new -x509 -key privatekey.pem -out server.crt -days 365

Linux

Run the same commands as macOS. OpenSSL is preinstalled on most distributions.

Open Salesforce JWT Authentication in Titan

1. Open Titan Dashboard > Settings > Integrations.
2. Make sure Salesforce is already authenticated.
3. In the SALESFORCE JWT SESSION row, select Authenticate. The Salesforce JWT Auth screen opens.

The Callback URL is generated automatically. Keep this screen open; you will copy the URL into Salesforce when configuring the external client app.  

Configure the External Client App in Salesforce

Create the App

1. In Salesforce, select the Setup gear icon at the top right, then select Setup.

2. In Quick Find, enter App Manager, then select External Client App Manager under Apps > External Client Apps.
3. Select New External Client App at the top right.

4. Under Basic Information, complete the following:
   • External Client App Name: Enter a descriptive name.
   • API Name: This fills automatically from the app name.
   • Contact Email: Enter your contact email address.
   • Distribution State: Leave this set to Local.

5. Under API (Enable OAuth Settings), select Enable OAuth.
6. Under App Settings, paste the URL copied from Titan into the Callback URL.
7. Under OAuth Scopes, move these scopes from Available OAuth Scopes to Selected OAuth Scopes:
   • Full access (full)
   • Perform requests at any time (refresh_token, offline_access)
8. Under Flow Enablement, select Enable JWT Bearer Flow. The Certificate Upload field appears.
9. Select Choose File beside Certificate Upload. 
10. Open the TitanJWT folder you created and select the certificate:
    • macOS or Linux: server.cert
    • Windows: server.crt
11. Select Open to attach the certificate. 
12. Under Security, select Require secret for Web Server Flow.
13. Select Create at the bottom of the form.

Authorize Users

1. On the app’s detail page, select the Policies tab.
2. Select Edit at the top right. The fields are read-only until you select Edit.

3. Expand OAuth Policies.
4. Under Plugin Policies, set Permitted Users to Admin approved users are pre-authorized.

5. Select OK if a confirmation appears. The profile and permission set lists appear under App Policies.
6. Under App Policies, leave Start Page set to None.
7. Under Select Profiles, scroll through Available Profiles and select the profile assigned to the Salesforce user you will use for the Titan integration, such as System Administrator.
8. Click the right-pointing arrow to move the profile to Selected Profiles. Repeat for any additional profiles that need JWT access.
9. Leave Selected Permission Sets empty when granting access through profiles.
10. Under OAuth Policies, leave OAuth Start URL and Apex Plugin Class blank.
11. Select Save.

When completing the authentication in Titan, enter the Salesforce username of a user with one of the selected profiles.

Complete Authentication in Titan

Copy the Consumer Key

Get the Consumer Key from the external client app you created in Salesforce.

1. In Salesforce Setup, search for and select External Client App Manager.
2. Open the external client app you created for the Titan integration.

3. Select the Settings tab and expand OAuth Settings.
4. Under App Settings, select  Consumer Key and Secret.

5. Complete the account verification when prompted. The Consumer Details page opens, displaying the Consumer Key and Consumer Secret.
6. Select Copy below Consumer Key. You will paste this value into Titan’s Consumer Key field.

Note: This setup uses the Consumer Key. You do not need to copy the Consumer Secret.

Enter the Authentication Details in Titan

1. Return to the Salesforce JWT Auth screen in Titan.
2. If you want to use JWT authentication for your Salesforce integration, select Use for Salesforce Integration. The Username field appears. This option is optional.

3. Complete the following fields
   • Username: If you selected Use for Salesforce Integration, enter the Salesforce username of a user authorized to access the external client app.
   • Consumer Key: Paste the key copied from Salesforce.
   • Audience: Enter the URL for the Salesforce environment where you created the external client app:
     • Production Salesforce org: https://login.salesforce.com
     • Sandbox Salesforce org: https://test.salesforce.com

Note: Use the Consumer Key and, if applicable, the authorized username from the same Salesforce environment. The private key must match the certificate uploaded to the external client app. Mixing details from different environments or apps will cause authentication to fail.

Optional: Use an Experience Cloud Site URL

Complete these steps only if your integration must authenticate through a specific Experience Cloud site (Community). Otherwise, keep the production or sandbox URL entered above.

1. In Salesforce Setup, enter Digital Experiences in Quick Find.
2. Under Digital Experiences, select All Sites.

Find Experience Cloud sites under Digital Experiences > All Sites.

3. Find the required site and copy its URL.
4. Return to Titan and paste the URL into Audience.

Note: If no sites are listed, use the production or sandbox URL.

Apply the Configuration

1. Open the privatekey.pem file generated earlier and copy its complete contents, including the BEGIN and END lines.
2. In Titan, paste the contents into Private Key.
3. Select Apply.

Titan can now authenticate with Salesforce using JWT and access Salesforce data according to the configured user’s permissions.

Frequently Asked Questions

Do I need an Enterprise license to use Salesforce JWT authentication?

No. Salesforce JWT authentication is available to Titan customers without an Enterprise license.

Where can I find my private key and certificate?

The files are saved in the folder where you ran the OpenSSL commands. If you followed this guide, open your TitanJWT folder.

• Private key: privatekey.pem. Copy its complete contents into Titan’s Private Key field, including the BEGIN and END lines.
• Certificate: server.cert on macOS or Linux, or server.crt on Windows. Upload this file to your Salesforce external client app.

What should I do if OpenSSL cannot find my private key?

Check that your terminal is open in the folder containing privatekey.pem and that you entered the filename correctly. Run pwd to check your current folder and ls to list its files.

Do I need the Consumer Key or Consumer Secret?

You need the Consumer Key. In Salesforce, open your external client app and go to Settings > OAuth Settings > App Settings > Consumer Key and Secret. Complete verification if prompted, then copy the Consumer Key into Titan.

Why can’t I see the Username field in Titan?

Select Use for Salesforce Integration on the Salesforce JWT Auth screen. The Username field appears. Enter the Salesforce username of a user authorized to access your external client app.

Which URL should I enter in the Audience field?

Use the URL for your Salesforce environment:

• Production: https://login.salesforce.com
• Sandbox: https://test.salesforce.com

Only use an Experience Cloud site URL if this integration must authenticate through that specific site.

Related Articles

• Connecting Titan to Salesforce
• Discover Titan Integrations
• Grant or Revoke Access to Third-Party Apps and Salesforce