---
schema_version: "1"
id: 03ee7ef810bb85c3d92c2698a3c7233222d3be9054a8e22eeceaffb9fef40d76
title: Create and Configure the External Client App (ECA) for the MCP Server
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/create_and_configure_the_eca.md
canonical_url: https://help.salesforce.com/s/articleView?id=ai.create_and_configure_the_eca.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 01ba79b621a479ea08dd5d85f551f7b87848f640d97ad769e604d536146855b3
description: The External Client App (ECA) connects Claude to your org's MCP Server through OAuth. If you created a permission set, assign it to the ECA as part of this task.
products:
  - Salesforce Platform
release: "264"
---
# Create and Configure the External Client App (ECA) for the MCP Server

The External Client App (ECA) connects Claude to your org's MCP Server through OAuth. If you created a permission set, assign it to the ECA as part of this task.

Creating a permission set is a separate, optional step. If you haven't decided whether to create one, see [Create the Permission Set](https://help.salesforce.com/s/articleView?id=ai.create_the_permission_set.htm&release=264.0.0&type=5 "Creating a permission set is optional but recommended. Without one, access is available to everyone in the org."). Without one, every user in the org gets access to the ECA. The steps in this task that reference a permission set are only relevant if you created one.

1. From Setup, in the Quick Find box, enter External Client App Manager, and select **External Client App Manager**. Click **New External Client App**.
2. Under **Basic Information**, enter the app name (Salesforce - Beta), API name, and contact email.
3. Under **API (Enable OAuth Settings)**, select **Enable OAuth**, set the callback URL to https://claude.ai/api/mcp/auth\_callback, and select these OAuth scopes.
    
    - Access Salesforce hosted MCP servers (`mcp_api`)
    - Perform requests at any time (`refresh_token, offline_access`)
4. Create the ECA.
5. If you created a permission set, on the ECA's **Policies** tab, under **App Authorization**, click **Edit**, and add it. If you skipped that step, skip this step too.
6. Set **Permitted Users** to **Admin approved users are pre-authorized**.
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-salesforce_platform-264-0-0-production-enus/46df459c-2fce-4d05-a889-03b20fe98d37/images/icon_important.png)
    
    Important Don't select a self-authorization option: it skips the permission set gate and allows users access the ECA without explicit authorization.
7. If you created a permission set, select it to authorize those users. If you didn't create one, the ECA authorizes every user in the org.
8. If you created a permission set, assign it to the users who should have access. Otherwise, skip this step.
9. Under **Settings** > **OAuth Settings** > **Security**, select **Issue JSON Web Token-based access tokens for named users**.
10. From **Settings**, go to **OAuth Settings** and note the Consumer Key and Secret. You need them to connect the MCP client.

Next, [connect Claude to Salesforce MCP](https://help.salesforce.com/s/articleView?id=sales.connect_claude_to_salesforce_mcp.htm&type=5&language=en_US) using the Consumer Key and Secret.