Generate a private key and public certificate #

In the console with OpenSSL installed (e.g., Git Bash), run the following commands:

# Generate a 2048-bit RSA private key in PKCS#8 format

openssl genpkey -algorithm RSA -out private_pkcs8.key -pkeyopt rsa_keygen_bits:2048

# Create a certificate signing request (CSR)

openssl req -new -key private_pkcs8.key -out request.csr

# Self-sign the certificate using the private key

openssl x509 -req -in request.csr -signkey private_pkcs8.key -out public.crt -days 365

 

This will generate:

• private_pkcs8.key: Your PKCS#8 private key (used to sign the JWT)
• public.crt: The X.509 certificate to upload in the Connected App

   

Salesforce Documentation – OAuth JWT Flow

 

Create a Connected App #

To connect Salesforce with Quality Clouds, create a Connected App within Salesforce.

Steps:

1. Create the App
   • In Lightning Experience:
     • Go to Setup
     • Enter App in the Quick Find box
     • Select App Manager
     • Click New Connected App
     • If using a newer version, select External Client App
       
       
   • In Salesforce Classic:
     • Go to Setup
     • Enter Apps in the Quick Find box
     • Select Apps (Build → Create)
     • Under Connected Apps, click New
       
       
2. Enter Application Details
   
   

Field	Value
Connected App Name	QualityClouds
API Name	QualityClouds
Contact Email	help@qualityclouds.com
Contact Phone	+44 20 3290 0456
Description	QualityClouds connection for REST API calls

 

1. Enable OAuth Settings
   
   

Configure the following OAuth settings:

Setting	Value
Callback URL	https://scan.qualityclouds.com/sf_instance/code_callback
OAuth Scope	Manage User Data via APIs (api)

These permissions allow Quality Clouds to:

• Access the logged-in user’s account via APIs (REST and Bulk APIs)

 

Additional Configuration

• • Enable Client Credentials Flow

  • Enable JWT Bearer Flow

  • Upload the public.crt file created earlier

  • OAuth Scopes – Ensure that Manage Data via API and Perform requests at any time (refresh_token, offline_access) are selected
    
    
  • Go to the Settings tab of the External Client App → OAuth Settings → Security section. Ensure “Issue JSON Web Token (JWT)-based access tokens for named users” is disabled.
    
    

  

   

• Click Save. Note: The Connected App can take 2–10 minutes to become active.

 

Configure Access to the Connected App #

You must authorize the Salesforce user to access the Connected App via JWT.

1. Go to External Client Apps Manager → locate your app → Edit Policies

2. Under OAuth Policies:

   • Set Permitted Users to:
     Admin approved users are pre-authorized
     
     

3. Save the changes

4. Assign access to the app via profiles or permission sets

The user defined in the sub claim of the JWT must have access to this app.

 

Step 4 – Retrieve the Consumer Key #

1. Go to the Connected App details

2. Scroll down to the OAuth Settings section

3. Copy the Consumer Key (this will be used when configuring the instance in Quality Clouds)

 

Use Case #

An administrator wants to connect a Salesforce org to Quality Clouds for automated quality analysis.

By creating a Connected App, they establish a secure OAuth connection that allows Quality Clouds to access Salesforce metadata via APIs and perform continuous platform scans.

Once configured, the Salesforce org can be added to Quality Clouds and scanned for quality and best-practice compliance.