Skip to main content

OAuth 2.0 configuration

The OAuth 2.0 credential fields for Salesforce and MaxCompute, and where to obtain them.

Two Apps use OAuth 2.0. The console describes the method this way: it delivers a secure, user-friendly sign-in through the OAuth 2.0 authorization flow. Users never hand their password to the platform. They are redirected to the target system to sign in and grant authorization, and what the platform receives is a revocable token.

Field reference

AppRequired fieldsOptional fields
Salesforce on Alibaba CloudOrg domain, Client ID, Client Secret—
MaxCompute—Scope
Beyond these, every config has the common Config name field. See Create an auth config.

Salesforce on Alibaba Cloud

Page hint: enter your Salesforce org domain and OAuth app credentials.
FieldRequiredDescription
Org domainYesThe address of your Salesforce on Alibaba Cloud org, in the form xxx.my.salesforce.com
Client IDYesThe Consumer Key of the Salesforce External Client App
Client SecretYesThe Consumer Secret of the Salesforce External Client App
The credentials come from an External Client App on the Salesforce side. Create an External Client App in Salesforce and enable its OAuth settings to obtain both values. The full steps are in the Salesforce documentation: Create an External Client App.

Configure OAuth

When you create the External Client App, set Callback URL to:
https://connector.aliyuncs.com/api/v1/bailian/connector/runtime/oauth/callback
Under OAuth Scopes, select at least these three scopes:
  • Manage user data via APIs (api)
  • Manage user data via Web browsers (web)
  • Perform requests at any time (refresh_token, offline_access)
The org domain must be your own org's address, not login.salesforce.com. Sandbox and production environments have different domains, so be careful not to mix them up.

MaxCompute

Page hint: enter the authorization scope (optional).
FieldRequiredDescription
ScopeNoThe permission scope. Leave it empty to use the default
MaxCompute is the only OAuth 2.0 config that requires no credentials at all — just one optional authorization scope. Click Finish to create it.

Credential rotation

Once the Client Secret is replaced in the target system, the original config stops working, and every connector built on it fails along with it. What to do: create a new auth config with the new credentials, rebuild the connector with the new config, and delete the old connector once you confirm the new one works.
Do not delete an OAuth app in the target system while it is still in use. The moment the app is deleted, every connector based on it breaks immediately and cannot be restored by authorizing again.

Troubleshooting authorization failures

SymptomCommon cause
Nothing happens after you click OKThe browser blocked the pop-up. Allow pop-ups and retry
The redirect reports an invalid appThe Client ID is wrong, or the app is not enabled in the target system
Authorization succeeds but tool calls failThe permission scope is insufficient, or the corresponding API is not enabled on the target system side
A redirect URI mismatch is reportedThe platform's redirect URI is not registered in the app in the target system
For Apps that need only an API Key — no app registration in the target system — see API Key configuration.
Agent Development
Agent Context
Agent Governance & Evolution
Store
Application Marketplace