The OAuth 2.0 credential fields for Salesforce and MaxCompute, and where to obtain them.
Two Apps use OAuth 2.0. The console describes the method this way: it delivers a secure, user-friendly sign-in through the OAuth 2.0 authorization flow.
Users never hand their password to the platform. They are redirected to the target system to sign in and grant authorization, and what the platform receives is a revocable token.
Beyond these, every config has the common Config name field. See Create an auth config.
Page hint: enter your Salesforce org domain and OAuth app credentials.
The credentials come from an External Client App on the Salesforce side. Create an External Client App in Salesforce and enable its OAuth settings to obtain both values.
When you create the External Client App, set Callback URL to:
Under OAuth Scopes, select at least these three scopes:
Page hint: enter the authorization scope (optional).
MaxCompute is the only OAuth 2.0 config that requires no credentials at all — just one optional authorization scope. Click Finish to create it.
Once the Client Secret is replaced in the target system, the original config stops working, and every connector built on it fails along with it.
What to do: create a new auth config with the new credentials, rebuild the connector with the new config, and delete the old connector once you confirm the new one works.
Field reference
| App | Required fields | Optional fields |
|---|---|---|
| Salesforce on Alibaba Cloud | Org domain, Client ID, Client Secret | — |
| MaxCompute | — | Scope |
Salesforce on Alibaba Cloud
Page hint: enter your Salesforce org domain and OAuth app credentials.
| Field | Required | Description |
|---|---|---|
| Org domain | Yes | The address of your Salesforce on Alibaba Cloud org, in the form xxx.my.salesforce.com |
| Client ID | Yes | The Consumer Key of the Salesforce External Client App |
| Client Secret | Yes | The Consumer Secret of the Salesforce External Client App |
Salesforce documentation: Create an External Client App
The full steps for creating an External Client App and obtaining the Consumer Key and Consumer Secret in Salesforce
Configure OAuth
When you create the External Client App, set Callback URL to:
Manage user data via APIs (api)Manage user data via Web browsers (web)Perform requests at any time (refresh_token, offline_access)
The org domain must be your own org's address, not
login.salesforce.com. Sandbox and production environments have different domains, so be careful not to mix them up.MaxCompute
Page hint: enter the authorization scope (optional).
| Field | Required | Description |
|---|---|---|
| Scope | No | The permission scope. Leave it empty to use the default |
Credential rotation
Once the Client Secret is replaced in the target system, the original config stops working, and every connector built on it fails along with it.
What to do: create a new auth config with the new credentials, rebuild the connector with the new config, and delete the old connector once you confirm the new one works.
Troubleshooting authorization failures
| Symptom | Common cause |
|---|---|
| Nothing happens after you click OK | The browser blocked the pop-up. Allow pop-ups and retry |
| The redirect reports an invalid app | The Client ID is wrong, or the app is not enabled in the target system |
| Authorization succeeds but tool calls fail | The permission scope is insufficient, or the corresponding API is not enabled on the target system side |
| A redirect URI mismatch is reported | The platform's redirect URI is not registered in the app in the target system |