--- schema_version: "1" id: 531ce5f4e32b1e79670acfce922525a2ccb20d8a469dd7ef57db7ea0705cce14 title: Configure Authentication If You Aren’t a Salesforce Voice with Telephony Providers Customer collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/agentforce_voice_realtime_streaming_auth_byo.md canonical_url: https://help.salesforce.com/s/articleView?id=ai.agentforce_voice_realtime_streaming_auth_byo.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: c0c2ab21279fc2446681bd85c66bdcc083ab5a64701c75c1573f563da2122325 description: If you aren’t a Salesforce Voice with Telephony Providers customer, deploy the SalesforceJwtRotatorNonScvStack CloudFormation stack to the same AWS account and region as the instance. Set the instance, org, and channel parameters. After the stack is created, replace the private-key placeholder in the -salesforce-secret secret with your RSA private key. Then run the rotator and confirm that the JWT secret contains a token before you use its ARN. The rotator generates the token, rotates it every 55 minutes, and writes the latest token into the JWT secret. The stack passes the JWT secret ARN to the contact flow. products: - Agentforce - Cross Cloud release: "264" --- # Configure Authentication If You Aren’t a Salesforce Voice with Telephony Providers Customer If you aren’t a Salesforce Voice with Telephony Providers customer, deploy the SalesforceJwtRotatorNonScvStack CloudFormation stack to the same AWS account and region as the instance. Set the instance, org, and channel parameters. After the stack is created, replace the private-key placeholder in the -salesforce-secret secret with your RSA private key. Then run the rotator and confirm that the JWT secret contains a token before you use its ARN. The rotator generates the token, rotates it every 55 minutes, and writes the latest token into the JWT secret. The stack passes the JWT secret ARN to the contact flow. 1. Verify that you already created the messaging channel for Agentforce Voice in Salesforce and specified the certificate in the Public Key field for that messaging channel. The channel can’t transfer calls to an agent without this certificate. See [Create the Channel for Agentforce Voice with Real-Time Streaming](https://help.salesforce.com/s/articleView?id=ai.agentforce_voice_channel_realtime_streaming.htm&release=264.0.0&type=5 "Create a Messaging channel to manage incoming calls transferred to the Agentforce agent. To route inbound calls to the agent using real-time streaming, create a Messaging channel that maps the incoming phone number to the Omni-Channel flow. The flow specifies the agent to route the incoming call to."). 2. Download the [SalesforceJwtRotatorNonScvStack.yaml](https://github.com/service-cloud-voice/ServiceCloudVoiceLambdas/tree/master/cloudformation/SalesforceJwtRotatorNonScvStack.yaml) stack. 3. Open AWS CloudFormation. 4. To start creating the stack, open the Stacks tab. 5. In the Stacks tab, click **Create Stack** and select **With New Resources (Standard)**. ![Create a CloudFormation stack with new resources](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/generative_ai/images/agentforce_voice_streaming_stack_create.png) 6. In the Create Stack page: 1. Select the same region as your Amazon Connect instance. For example, if your instance is in Oregon (us-west-2), deploy the stack to that region. 2. Select **Choose an Existing Template**. 3. Select **Upload a Template File**. 4. Click **Choose File**. 5. Click **Next**. 7. In the Specify Stack Details tab: 1. Enter any stack name. 2. Set these stack parameters. - `CallCenterApiName`. Leave the name empty. You don’t have a Salesforce Voice contact center. - `ConnectInstanceId`. Enter the Amazon Connect instance ID. This value limits decrypt and read access to this instance. To get the instance ID, in the Amazon Connect console, open Amazon Connect Customer in the same region. The ID is the last part of the instance ARN. ![Amazon Connect instance ID at the end of the instance ARN](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/generative_ai/images/agentforce_voice_streaming_amazon_instanceid.png) - `MessagingChannelApiName`. Enter the developer name of the messaging channel created in Salesforce. When you set it, the stack uses it instead of `CallCenterApiName` for the JWT `sub` claim and for secret names. - `PermissionBoundaryARN`. Leave the default value, unless the account requires a permissions boundary. - `S3BucketForScvResources`. Leave the default value. - `SalesforceOrgId`. Enter the Salesforce org ID. You can get the org ID from the Company Information page under Setup. This ID becomes the JWT `iss` claim. - `SalesforceRelease`. Leave the default value. - `Version`. Leave the default value. 3. Click **Next**. 8. In the Configure Stack Options tab, scroll down to the Capabilities and Transforms section, select the three checkboxes, and click **Next**. ![Capabilities selected for the CloudFormation stack](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/generative_ai/images/agentforce_voice_streaming_stack_config.png) 9. In the Review and Create tab, keep the defaults, and click **Submit**. 10. Launch the stack. This provisions the KMS key, both secrets (with a placeholder value in the private-key field), the Lambda functions, IAM roles, and the EventBridge schedule. After deployment, the stack creates the resources that generate the JWT token, including two secrets. The `-salesforce-jwt-secret` secret stores the messaging channel API name and the Salesforce org ID. The `-salesforce-secret` secret stores the private key, which you will add now. ![Resources created by the JWT rotator stack](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/generative_ai/images/agentforce_voice_streaming_stack_resources.png) 11. After the stack creation completes, replace the private-key placeholder. 1. In AWS Secrets Manager, open the `-salesforce-secret` config secret. 2. In the Secret Value section, click **Retrieve Secret Value**. 3. In `-scrt-jwt-auth-private-key`, replace `REPLACE_WITH_PRIVATE_KEY` with the RSA private key that matches the public key in Salesforce. The rotator can’t sign a valid token until you replace that placeholder value. 4. To set the value, in the Overview tab, click **Retrieve Secret Value**, and then edit the `-scrt-jwt-auth-private-key` secret key to add the private key. ![Private key field in the Salesforce secret](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/generative_ai/images/agentforce_voice_streaming_secret.png) 5. Run the `JwtTokenRotatorFunction` Lambda function once, or wait for the next run. The rotator runs about every 55 minutes. When the rotator runs, it updates the placeholder value for the `-salesforce-jwt-secret` secret with the JWT token. After the rotator runs, the secret is updated with the JWT token. ![Placeholder value in the Salesforce JWT secret](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/generative_ai/images/agentforce_voice_streaming_jwtsecret.png) 6. Open `-salesforce-jwt-secret` and confirm that it contains a real token value, not `PLACEHOLDER-AFV-JWT-TOKEN`. In [Register the A2A Application](https://help.salesforce.com/s/articleView?id=ai.agentforce_voice_register_a2a_application.htm&release=264.0.0&type=5 "Create an Agent-to-Agent (A2A) server application that points Amazon Connect at your public Agentforce WebSocket URL and JWT secret. Save the application ID and ARN, and confirm the application type, URL, authentication type, and JWT secret ARN."), set the JWT secret ARN of the `-salesforce-jwt-secret` token secret in the `CredentialProviderIdentifier` parameter. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/images/icon_note.png) Note Deleting the stack deletes both secrets, including the private key and the active token. Authentication stops until you deploy the stack again and restore the private key. A later stack update keeps a private key that you already set. #### See Also - [JwtTokenRotatorFunction Lambda Function](https://developer.salesforce.com/docs/atlas.en-us.voice_developer_guide.meta/voice_developer_guide/voice_lambda_jwtrotator.htm)