Tableau Next Tips #7 : Authenticate for Tableau Next Salesforce REST API Endpoints

To use Tableau Next Salesforce REST API endpoints, your application must be authenticated first. Authentication makes sure that only trusted applications can access Salesforce and Tableau Next data.

Salesforce uses OAuth security, and for server-to-server access, the JWT (JSON Web Token) flow is commonly used.

What Is Tableau Next REST API?

The Tableau Next REST API is a REST-based API that allows your application to securely connect with large language models (LLMs) and Tableau Next features inside Salesforce.

Before making any API call, Salesforce needs to know who your application is.

Simple Authentication Flow (JWT-Based)

Here’s the authentication process in easy steps:

Step 1: Create a Salesforce App for Tableau Next REST API Access

Before you can start using the Tableau Next REST API, you need a secure way for your application to communicate with Salesforce. Salesforce provides two app options for this:

• External Client App (ECA) — Recommended
• Connected App — Legacy option

Both app types support secure integration using standard authorization protocols like OAuth, but External Client Apps (ECAs) are the newer and preferred approach. In this guide, we’ll focus on creating an External Client App.

Create an external client app with OAuth and JWT enabled. Use these instructions to get set up: Create a Local External Client App

App Settings and OAuth Scopes to Enable

When you create your External Client App (or Connected App), it’s important to configure the correct OAuth settings. These settings define what your app is allowed to access inside Salesforce.

Required OAuth Scopes

Add the following OAuth scopes to your app. These scopes are mandatory for working with the Tableau Next REST API.

1. Manage User Data via APIs (api)

This scope allows your application to:

• Access Salesforce user and org data
• Read and interact with Tableau Next assets
• Make standard Salesforce API calls

👉 This is the core permission: without it, API access won’t work.

2. Perform Requests at Any Time (refresh_token, offline_access)

This scope allows your application to:

• Refresh OAuth access tokens automatically
• Continue working even when no user is logged in
• Support long-running background jobs and integrations

👉 This is essential for server-to-server and automated integrations using JWT.

3. Access the Salesforce API Platform (sfap_api)

This scope allows your application to:

• Access Salesforce REST API platform services
• Call Tableau Next REST API endpoints
• Interact with platform-level Salesforce APIs

👉 Required specifically for Tableau Next and modern Salesforce APIs.

Summary Table

OAuth ScopePurposeapiAccess Salesforce user data and APIsrefresh_token, offline_accessGenerate and refresh access tokenssfap_apiAccess Salesforce REST API platform and Tableau Next APIs

Important Tip

Always grant only the scopes you need, but for Tableau Next REST API integrations, all three scopes above are required.

Once these settings are configured, your app is ready to authenticate securely with Salesforce and call Tableau Next REST API endpoints.

👉 Next step: Generate a JWT and exchange it for an OAuth access token.

Step 2: Generate a JWT for Tableau Next REST API

After creating your Salesforce app, the next step is to generate a JSON Web Token (JWT).
This JWT is used to authenticate your application and securely access the Tableau Next REST API.

JWT-based authentication is ideal for server-to-server integrations because it does not require user login.

What Is a JWT?

A JSON Web Token (JWT) is a secure token that Salesforce issues after verifying your app’s credentials.
You’ll use this token to:

• Prove your app’s identity
• Access Salesforce and Tableau Next APIs
• Pass authorization in API requests

Step-by-Step: Generate a JWT

1. Open External Client Apps Manager

1. Go to Setup
2. In Quick Find, search for External Client Apps
3. Select External Client Apps Manager
4. Click on your app name

2. Get Consumer Key and Consumer Secret

1. Open the Settings tab of your app
2. Expand the OAuth Settings section
3. Click Consumer Key and Secret
4. Copy both values

⚠️ Important:
Store your Consumer Secret securely. Never commit it to source code or share it publicly.

3. Find Your My Domain URL

1. Go to Setup
2. In Quick Find, search for My Domain
3. Copy the value from Current My Domain URL

Example:

https://mycompany.my.salesforce.com

You’ll use this domain to request your JWT.

Request a JWT from Salesforce

Now you can request a JWT by making a POST request to Salesforce’s OAuth token endpoint.

Sample Token Request

curl -X POST https://{my_domain}/services/oauth2/token \
-d "grant_type=client_credentials&client_id={consumer_key}&client_secret={consumer_secret}

Replace the placeholders:

• {my_domain} → Your My Domain URL
• {consumer_key} → App Consumer Key
• {consumer_secret} → App Consumer Secret

Sample Token Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "signature": "uSs/SAlD/i+pL93EdLVUUY4F8uqfHHtteFii2E3zkhc=",
  "token_format": "jwt",
  "scope": "sfap_api analytics_agent_api api",
  "instance_url": "https://sample-company.my.salesforce.com",
  "id": "https://login.pc-rnd.salesforce.com/id/XYZ/ABC",
  "token_type": "Bearer",
  "issued_at": "1713195676742",
  "api_instance_url": "https://api.salesforce.com"
}

Common Error & Fix

❌ Error

invalid_grant: request not supported on this domai

✅ Fix

• Double-check that the My Domain URL used in the request
• It must exactly match the domain shown in Setup → My Domain

Use the Access Token in API Requests

From the response, copy the value of access_token.
This token is required in the Authorization header for all Tableau Next REST API calls.

Sample Authorization Header

Authorization: Bearer {access_token}

• Salesforce Help: External Client Apps
• Salesforce Help: Connected Apps