Salesforce administrator prerequisites for Zapier connection

This guide is for Salesforce administrators. If your organization requires a custom app for Zapier, you must create an External Client App and share the credentials with your team before they can connect Salesforce to Zapier.

As of the Salesforce Spring '26 release, External Client Apps replace Connected Apps for new setups. Existing Connected Apps are unaffected and continue to work. The OAuth scope and refresh token requirements in this guide apply to both External Client Apps and Connected Apps.

Prerequisites

Before you create the External Client App, confirm you have:

• Administrator permissions in your Salesforce org.
• Access to Salesforce Setup.
• My Domain configured in your org.

1. Create an External Client App

1. In Salesforce, click the gear icon and select Setup.
2. In the Quick Find box, search for External Client App Manager.
3. Click Create New External Client App.
4. Enter the following basic information:
   • External Client App Name: A name for the app (for example, Zapier).
   • Contact Email: Your admin email address.
   • Distribution State: Select Local.
5. Scroll down to the API (Enable OAuth Settings) section and select the Enable OAuth checkbox.
6. In the Callback URL field, enter: https://zapier.com/dashboard/auth/oauth/return/SalesforceCLIAPI/
7. Under Selected OAuth Scopes, add all four of the following scopes. Zapier's authorization request includes every one of them, and Salesforce rejects the connection with an invalid_scope error if any one of them is missing.
   • Access the identity URL service (id)
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
   • Full access (full)
8. Uncheck Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows.
9. Click Create.

Note

Full access (full) is required and cannot be omitted. It does not grant Zapier more access than the connecting user already has: their Salesforce profile and permission sets still control which records and fields Zapier can reach. If Full access (full) is not enabled on the app, the connection cannot be authorized at all.

2. Configure the refresh token policy

Configure the refresh token policy so connections remain active.

1. In Setup, go to External Client App Manager.
2. Open the app you created.
3. Click the Policies tab, then click Edit.
4. Under Refresh Token Policy, select Refresh token is valid until revoked.
5. Leave Refresh Token Rotation disabled.
6. Click Save.

Note

Zapier stores a single refresh token for each connection and cannot save a replacement. If you enable Refresh Token Rotation, Salesforce issues a new token that Zapier cannot store, and the connection stops working at a later refresh, long after setup.

To limit how long a refresh token stays valid, use Refresh Token Validity instead. Each expiry requires the connecting user to sign in again.

3. Share credentials with your team

On the app's Settings tab, open the OAuth Settings section and retrieve:

• Consumer Key
• Consumer Secret

Provide these credentials to the members of your organization who need to connect Salesforce to Zapier.