---
schema_version: "1"
id: 50821d5f58b8690a9ec225dc2607f2afa3652cb95ce703cf98153fccbb516b67
title: Set Up Point of Sale External Client App for Service
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/rt_adv_config_sf_int_eca.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.rt_adv_config_sf_int_eca.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ebcfe9e14c33188e0633ff508332f152af02f015751ea5f391ff76264d118b7d
description: Create an External Client App (ECA) to provide Point of Sale access to Salesforce APIs for clienteling purposes. As of Spring '26, new merchants must use External Client Apps instead of Connected Apps.
products:
  - Commerce
release: "264"
---
# Set Up Point of Sale External Client App for Service

Create an External Client App (ECA) to provide Point of Sale access to Salesforce APIs for clienteling purposes. As of Spring '26, new merchants must use External Client Apps instead of Connected Apps.

Point of Sale needs the following credentials to access the Salesforce portal:

- URL: Salesforce instance URL
- Username
- Password
- Client ID (Consumer Key) of the External Client App
- Client Secret (Consumer Secret) of the External Client App

Refer to [POS Access List - URLs and IP Addresses](https://help.salesforce.com/s/articleView?id=commerce.rt_adv_config_3p_int_erp_pos_access_list.htm&release=264.0.0&type=5 "To enable POS and cloud services to interact with external, third-party services, allowlist specific URLs and IP addresses within the merchant's firewall. Ensure necessary communication for Adyen Payments, Elavon Payments, and other connectors by allowlisting URLs configured on CMS and product or order systems. The in-store IT team handles store firewall and POS app URLs, while the corporate IT team manages backend outbound NAT gateway IPs for connectors.") for a list of URLs and IP addresses to be allowlisted. This is to enable the necessary communication.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-retail-264-0-0-production-enus/17d647fb-8988-49fb-9add-c4f4cc79c9e4/images/icon_important.png)

Important As of Spring '26, new connected apps can no longer be created. New merchants must create an External Client App instead. If you already have a connected app, you can continue using it. See [Set Up the Connected App for Service](https://help.salesforce.com/s/articleView?id=commerce.rt_adv_config_sf_int_connect_app.htm&release=264.0.0&type=5 "Provide Point of Sale access to a Salesforce Connected App using whichever Salesforce APIs can be invoked for Clienteling purposes.") for instructions on using existing connected apps.

1. Work with your Salesforce admin team to create an External Client App that supports the Client Credentials OAuth flow.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-retail-264-0-0-production-enus/17d647fb-8988-49fb-9add-c4f4cc79c9e4/images/icon_note.png)
    
    Note Refer to [External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) in Salesforce Help.
2. Log in to your Salesforce org.
    
    Log in at login.salesforce.com or at your My Domain URL, if set up by your administrator.
3. In Setup, go to **Quick Find** | **External Client App Manager**.
4. Click **New External Client App**.
5. In the Basic Information section, complete the required fields.
    
    - App Name
    - API Name
    - Contact Email
    - Description (optional)
6. Under API (Enable OAuth Settings), select **Enable OAuth**.
7. For the **Callback URL**, enter a valid callback URL.
    
    For testing purposes, you can use `https://login.salesforce.com/services/oauth2/success`.
8. In the **Selected OAuth Scopes** section, add the following scope:
    
    - **Manage user data via APIs (api)**
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-retail-264-0-0-production-enus/17d647fb-8988-49fb-9add-c4f4cc79c9e4/images/icon_important.png)
    
    Important
    
    **OAuth Scope Requirements:**
    
    - **Do NOT add** `full` (Access and manage your data) — This scope breaks the client credentials flow.
    - **Do NOT add** `refresh_token` (Perform requests at any time) — This scope is not applicable for client credentials flow.
9. Select **Enable Client Credentials Flow**.
    
    This is required for Point of Sale authentication.
10. Click **Save** or **Create**.
11. After the External Client App is created, copy the **Consumer Key** and **Consumer Secret**.
    
    You need these values to configure Point of Sale.
12. Navigate back to **External Client App Manager** and click your app name.
13. Click **Edit Policies**.
14. Under **Client Credentials Flow**, search for and select a **Run As** user.
    
    This is the integration user that Point of Sale will use to access Salesforce APIs. The selected user must have appropriate permissions to access the required Salesforce objects (Account, Notes, etc.).
15. Configure IP Relaxation settings as needed for your organization's security requirements.
16. Click **Save**.
17. In the Quick Find box, search for **OAuth** and select **OAuth and OpenID Connect Settings**.
18. Verify that **Allow OAuth Username-Password Flows** is enabled.
    
    This setting may be required depending on your authentication flow requirements.
19. Create a new Salesforce user or use an existing integration user to provide access to your External Client App.
20. Share the following credentials with Point of Sale:
    
    - Salesforce instance URL
    - Username and password of the integration user
    - Consumer Key (Client ID)
    - Consumer Secret

![Testing the External Client App](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-retail-264-0-0-production-enus/17d647fb-8988-49fb-9add-c4f4cc79c9e4/images/icon_example.png)

Testing the External Client App

Point of Sale uses the following curl command to obtain an access token and access Salesforce APIs:

```
curl -i -L -X POST \
  -H "Content-Type:application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CONSUMER_KEY" \
  -d "client_secret=YOUR_CONSUMER_SECRET" \
  'https://YOUR_INSTANCE.salesforce.com/services/oauth2/token'
```

Replace `YOUR_CONSUMER_KEY`, `YOUR_CONSUMER_SECRET`, and `YOUR_INSTANCE` with your actual values.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-retail-264-0-0-production-enus/17d647fb-8988-49fb-9add-c4f4cc79c9e4/images/icon_note.png)

Note The client credentials flow uses `grant_type=client_credentials` and does not require username and password in the token request.

Point of Sale can now use the access token to query and update Salesforce objects like Account, Notes, and other objects configured for clienteling purposes.