--- schema_version: "1" id: 18d458c029b89e98c3b7991d863b991fb5a46b6185dd7704220f1b0550e2fe51 title: DCG External Client App Setup collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/industries/cme/guides/comms-t-dcg-external-client-app.md canonical_url: https://developer.salesforce.com/docs/industries/cme/guide/comms-t-dcg-external-client-app.html source_site: developer.salesforce.com content_type: documentation content_hash: 872cea808441b2a700e5e029c99172126c2b046a0370b02ebd8e168af213b54a products: - Communications, Media, Energy and Utilities APIs (Managed Package) - Industries Developer Documentation --- # DCG External Client App Setup This topic guides you through the creation of an external client app to be used by the Digital Commerce Gateway (also known as DCG application, formerly known as Vlocity Digital Commerce Tier - VDCT). **note:** The documentation in this section applies only to customers who have purchased the Digital Commerce Gateway license. The instructions provided don't work without the Digital Commerce Gateway license. The DCG External Client App Setup process is required during these events: - Initial DCG setup. - Integration of an existing DCG environment with a different Salesforce organization. - Re-integration after a sandbox refresh where the external client app must be recreated. ## Prerequisites To create the external client app, you must have an admin account within the Salesforce organization. The callback URL to configure in the connected application will differ depending on the type of Salesforce instance used (test or standard). - For sandbox / test instances: https://test.salesforce.com/services/oauth2/success - For production / standard instances: https://login.salesforce.com/services/oauth2/success The DCG application relies on the OAuth 2.0 JWT Bearer Token authentication flow which requires a private key and certificate to work. Vlocity creates them and provides you with the public certificate to add to the external client app at a later stage. You do not need this certificate to create the external client app. DCG requires a dedicated user who is authorized to use the external client app. The user must be assigned to a Profile with sufficient permissions for the DCG application to work. The “System Administrator” profile is the recommended one for DCG; however, its permissiveness is generally not recommended for production environments. ## Creating the application To create the external client app, see [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5). After you reach the external client app creation page, configure it as follows: - Provide a name for the application similar to: “Digital Commerce Application - {ENV}” (replacing {ENV} with the appropriate environment name / nickname). - Provide an email address where you can receive notifications related to the connected application. - Expand API (Enable OAuth Settings) and check **Enable OAuth**. - Fill in the Callback URL (refer to the Prerequisites section above for possible values). - Add the following Oauth Scopes (or permissions) to the **Selected Oauth Scopes**: - Manage user data via APIs (api) - Perform requests at any time (refresh_token, offline_access) ![DCG OAuth](https://developer.salesforce.com/docs/media/dcg_oauth2_new1.png) ## Authorize the User to Access the External Client App DCG requires a user who is authorized to use the external client app. This user must be assigned to a Profile with sufficient permissions for the DCG application to work. The “System Administrator” profile is the most commonly used. ![DCG Policy](https://developer.salesforce.com/docs/media/dcg_app_policies_new1.png) ![DCG Plugin](https://developer.salesforce.com/docs/media/dcg_plugin_new1.png) ## Send the External Client App Information to Vlocity Update the ticket with the following required information from the external client app: - The Salesforce username authorized in the application - The external client app API Oauth Consumer Key **note:** It is not necessary to send either the Salesforce password for the username or the Connected Application API Oauth Consumer Secret. ## Upload the Public Certificate to the External Client App After Salesforce has finalized the creation of your environment and has sent you the public certificate, proceed with the post-setup instructions here. The public certificate may be sent to you in PEM or DER format. Both are accepted by external client apps. When the certificate is nearing expiration, a new one is generated and provided to you by Salesforce. To add or replace the certificate, follow these steps: 1. Log in to the Salesforce Org and navigate to **Setup** 2. From Setup, in the Quick Find box, enter _App_, and then select **External Client App Manager**. ![DCG External App](https://developer.salesforce.com/docs/media/dcg_external_app_new1.png) 3. Locate the app you created for this environment and open it. 4. On the settings tab click **Edit**. 5. Locate and check the setting Enable JWT Bearer Flow in the API section. ![DCG Flow](https://developer.salesforce.com/docs/media/dcg_flow3_new.png) 6. Click **Upload Files** and upload the public certificate file you received from Salesforce. 7. Click **Save**. You can display the certificate’s properties using the following command (subject, issuer and expiration date): ```nolang > openssl x509 -in myenv-external-client-app-public-certificate.pem -subject -dates -issuer -noout Example output: subject=C=US, ST=CA, L=SANFRANSISCO, O=Devops, OU=IT Department, CN=myenv.vlocity.salesforce.com notBefore=Apr 15 16:36:15 2022 GMT notAfter=Apr 15 16:36:15 2023 GMT issuer=C=US, ST=CA, L=SANFRANSISCO, O=Devops, OU=IT Department, CN=myenv.vlocity.salesforce.com ```