---
schema_version: "1"
id: 01f9ea7368c70673c366f750a1ab9407e99759146bc6375cef88201a75cd0413
title: Authenticate to the Models API
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/genai/agentforce/guides/models/models-api/models-api-authentication.md
canonical_url: https://developer.salesforce.com/docs/ai/agentforce/guide/models-api-authentication.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: b4672be2d255080f4beef1d824454ca0f4443e7b2ce5aa0990b95bdc4ff38d6e
products:
  - Agentforce Developer Guide
  - Agentforce and Einstein Generative AI
---
# Authenticate to the Models API

Before you call any Models API endpoint, whether generative or predictive, create a Salesforce app and generate a JSON Web Token (JWT). This authentication flow is shared across every REST-based Models API capability, so complete it once and reuse the resulting token for both generation and prediction requests.

![API Flow](https://developer.salesforce.com/media/api-onboarding-steps.svg '{"class": "image-full"}')

## Video Tutorial

This video walks through the org setup and token generation steps below.

::video{src="https://developer.salesforce.com/docs/ai/agentforce/guide/CuJRahNcxoVFTA6bwRdhXW" title="Authenticate to the Models API" type="vidyard"}

## Step 1. Create a Salesforce App

To securely communicate with Salesforce using the Models API, create an [External Client App](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm).

Create an external client app with OAuth and JWT enabled. Use these instructions to get set up: [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm).

When creating the app, include these settings.

1. Use these OAuth scopes.

   - **Manage user data via APIs (api):** Gives you access to user data.
   - **Perform requests at any time (refresh_token, offline_access):** Permits you to get an OAuth access token.
   - **Access the Salesforce API Platform (sfap_api):** Enables access to the Salesforce REST API platform.

   ![OAuth settings scope](https://developer.salesforce.com/media/oauth-settings-1.png)

2. Select these additional OAuth settings.

   - **Enable Client Credentials Flow:** Allows your app to exchange its client credentials for an access token.
   - **Issue JWT Web Token (JWT)-based access tokens for named users:** Allows app to issue tokens for named users.

   ![OAuth settings checkboxes](https://developer.salesforce.com/media/oauth-settings-2b.png)

3. After creating the app, ensure that the API caller has the correct client credentials and that the client can issue JWT-based access tokens.

   - Click the **Policies** tab for the app, and then click **Edit**.
   - Select the **Enable Client Credentials Flow** checkbox.
   - Specify the client user in the **Run As** field.
   - Select the **Issue JSON Web Token (JWT)-based access tokens** checkbox. By default, this token expires in 30 minutes. You can change this value to less than 30 minutes.

   ![OAuth user settings](https://developer.salesforce.com/media/oauth-settings-3.png '{"class": "image-md"}')

## Step 2. Generate a JWT

A JSON Web Token (JWT) is required for authorization.

1. From Setup, in the Quick Find box, enter `External Client Apps`, and then select **External Client Apps Manager**.
2. Select your app, and click the **Settings** tab.
3. Expand the **OAuth Settings** section.
4. Click the **Consumer Key and Secret** button, and copy your key and secret. You need these values to mint this token.

   **important:** Store your consumer secret in a secure location.

5. From Setup, in the Quick Find box, enter `My Domain`, and then select **My Domain**.
6. Copy the value shown in the **Current My Domain URL** field.
7. Request a JWT from Salesforce using a POST request, specifying the values for your domain, consumer key, and consumer secret. For example:

   ```bash
curl -X POST https://{my_domain}/services/oauth2/token -d "grant_type=client_credentials&client_id={consumer_key}&client_secret={consumer_secret}"
```

   ```json
{"access_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IlNBTVBMRSBKV1QgRk9SIERFTU8gUFVSUE9TRVMiLCJpYXQiOjE1MTYyMzkwMjJ9.XYwlhE_q0-yVwswgaXuOx2nbXRFpEbagcScXnjWt2yo","signature":"uSs/SAlD/i+pL93EdLVUUY4F8uqfHHtteFii2E3zkhc=","token_format":"jwt","scope":"sfap_api einstein_gpt_api api","instance_url":"https://sample-company.my.salesforce.com","id":"https://login.pc-rnd.salesforce.com/id/XYZ/ABC","token_type":"Bearer","issued_at":"1713195676742","api_instance_url":"https://api.salesforce.com"}
```

   **tip:** If you receive an `invalid_grant` error with the description, `request not supported on this domain`, verify that the domain is the domain specified when you view **My Domain** in Setup.

8. Use the `access_token` value in this response for the `Authorization` header in your API requests. For example:

   ```bash
Authorization: Bearer {access_token}
```

## Next Steps

With a valid access token, call any Models API endpoint over REST.

- [Access Models API with REST](https://developer.salesforce.com/docs/ai/agentforce/guide/access-models-api-with-rest.md) — generative endpoints for chat, embeddings, text, and feedback.
- [Access Predictive Endpoints with REST](https://developer.salesforce.com/docs/ai/agentforce/guide/access-predictive-endpoints-with-rest.md) — predictive endpoints for classification and regression.

## See Also

- [Access Models API with Apex](https://developer.salesforce.com/docs/ai/agentforce/guide/access-models-api-with-apex.md) — Apex classes handle authentication for you; no JWT setup required.
- _Salesforce Help_: [External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm)
- _Salesforce Help_: [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm)