The OAuth 2.0 credential fields for Salesforce and MaxCompute, and where to obtain them.
Two Apps use OAuth 2.0. The console describes the method this way: it delivers a secure, user-friendly sign-in through the OAuth 2.0 authorization flow.
Users never hand their password to the platform. They are redirected to the target system to sign in and grant authorization, and what the platform receives is a revocable token.
Beyond these, every config has the common Config name field. See Create an auth config.
Page hint: enter your Salesforce org domain and OAuth app credentials.
The credentials come from a Connected App on the Salesforce side. Create a Connected App in Salesforce and enable its OAuth settings, and both values become available.
Page hint: enter the authorization scope (optional).
MaxCompute is the only OAuth 2.0 config that requires no credentials at all — just one optional authorization scope. Click Finish to create it.
Once the Client Secret is replaced in the target system, the original config stops working, and every connector built on it fails along with it.
What to do: create a new auth config with the new credentials, rebuild the connector with the new config, and delete the old connector once you confirm the new one works.
Field reference
| App | Required fields | Optional fields |
|---|---|---|
| Salesforce | Org domain, Client ID, Client Secret | — |
| MaxCompute | — | Scope |
Salesforce
Page hint: enter your Salesforce org domain and OAuth app credentials.
| Field | Required | Description |
|---|---|---|
| Org domain | Yes | The address of your Salesforce org, in the form xxx.my.salesforce.com |
| Client ID | Yes | The Client ID of the Salesforce Connected App |
| Client Secret | Yes | The Client Secret of the Salesforce Connected App |
Salesforce documentation: Create a Token
The full steps for creating a Connected App and obtaining the Client ID and Client Secret in Salesforce
The org domain must be your own org's address, not
login.salesforce.com. Sandbox and production environments have different domains, so be careful not to mix them up.MaxCompute
Page hint: enter the authorization scope (optional).
| Field | Required | Description |
|---|---|---|
| Scope | No | The permission scope. Leave it empty to use the default |
Credential rotation
Once the Client Secret is replaced in the target system, the original config stops working, and every connector built on it fails along with it.
What to do: create a new auth config with the new credentials, rebuild the connector with the new config, and delete the old connector once you confirm the new one works.
Troubleshooting authorization failures
| Symptom | Common cause |
|---|---|
| Nothing happens after you click OK | The browser blocked the pop-up. Allow pop-ups and retry |
| The redirect reports an invalid app | The Client ID is wrong, or the app is not enabled in the target system |
| Authorization succeeds but tool calls fail | The permission scope is insufficient, or the corresponding API is not enabled on the target system side |
| A redirect URI mismatch is reported | The platform's redirect URI is not registered in the app in the target system |