This guide walks through the complete process of setting up secure, certificate-based, server-to-server authentication between Salesforce and MuleSoft (Anypoint Studio) using the OAuth 2.0 JWT Bearer Flow. This method allows an integration user or external system to authenticate with Salesforce using a signed JSON Web Token — no interactive login required.

The setup involves six major stages:

  1. Creating a self-signed certificate in Salesforce
  2. Exporting the certificate to a Java KeyStore (.jks) file
  3. Creating an External Client App (Connected App) in Salesforce
  4. Enabling the JWT Bearer Flow and uploading the certificate
  5. Configuring App Policies and OAuth Policies
  6. Configuring the JWT connection in Anypoint Studio and testing it

Prerequisites: This process is intended for Salesforce Administrators and MuleSoft Integration Developers. You will need System Administrator access in Salesforce and access to Anypoint Studio.

Part 1: Create a Self-Signed Certificate in Salesforce

The certificate is used to digitally sign the JWT (JSON Web Token) that MuleSoft sends to Salesforce for authentication. Salesforce verifies this signature using the same certificate that was uploaded to the External Client App.

  1. In Salesforce, go to Setup and search for Certificate and Key Management.
  2. Click Create Self-Signed Certificate.
  3. Enter a Label and Unique Name for the certificate (letters, numbers, and underscores only).
  4. Ensure Exportable Private Key is checked, since the private key will need to be exported into the keystore in the next step.
  5. Click Save.
Certificates and Keys Edit form used to create a new self-signed certificate
Figure 1: Certificates and Keys Edit form used to create a new self-signed certificate.

Once saved, the certificate appears in the Certificate and Key Management list along with its expiration date and key size. From this page also download the certificate file (.crt) — it is needed separately for the connected app upload.

Certificate and Key Management page showing the newly created self-signed certificate
Figure 2: Certificate and Key Management page showing the newly created self-signed certificate.

Part 2: Export the Certificate to a Keystore (.jks)

MuleSoft's JWT connector requires the private key in Java KeyStore (JKS) format. Salesforce provides a built-in option to export all certificates in the org directly into a .jks file.

  1. From the Certificate and Key Management page, click Export to Keystore.
  2. Enter and confirm a Keystore Password. This password protects the .jks file and will be required again later in Anypoint Studio, so store it securely (e.g., in a password manager or secrets vault).
  3. Click Export. Salesforce will generate and download a .jks file containing all non-expired certificates in the org.
Export to a Keystore dialog — all certificates in the org are bundled into a single JKS file
Figure 3: Export to a Keystore dialog — all certificates in the org are bundled into a single JKS file.

Checkpoint: At this point you should have two files saved locally: the certificate file (.crt, optional) and the keystore file (.jks). Both are needed for the Anypoint Studio configuration in Part 5.

Part 3: Create an External Client App in Salesforce

The External Client App (the modern equivalent of a Connected App) is what MuleSoft authenticates against. It defines the OAuth scopes, the JWT Bearer Flow, and which certificate Salesforce should trust.

3.1 Navigate to the App Manager

  1. In Setup, search for App Manager, then open External Client Apps → External Client App Manager.
  2. Click New External Client App.
External Client App Manager showing existing apps in the org
Figure 4: External Client App Manager showing existing apps in the org.

3.2 Fill in Basic Information

Complete the required fields under Basic Information:

FieldDescription
External Client App NameA descriptive name for the app, e.g. MuleSoft_JWT_Integration.
API NameAuto-populated from the app name; can be edited.
Contact EmailEmail address of the app owner/administrator.
Distribution StateSet to Local for internal, org-specific integrations.

3.3 Enable OAuth Settings

  1. Expand the API (Enable OAuth Settings) section and enable it.
  2. Enter a Callback URL (a valid URL is required even though it is not used directly by the JWT Bearer Flow).
  3. Under OAuth Scopes, move the scopes required by your integration — for example, Manage user data via APIs (api), Perform requests at any time (refresh_token, offline_access) — from Available OAuth Scopes to Selected OAuth Scopes.
App Settings — Callback URL and OAuth Scopes selection
Figure 5: App Settings — Callback URL and OAuth Scopes selection.

3.4 Enable the JWT Bearer Flow and Upload the Certificate

  1. Scroll to Flow Enablement.
  2. Check Enable JWT Bearer Flow.
  3. Under Certificate Upload, click Upload Files and select the certificate (.crt) exported in Part 1.
  4. Click Create / Save to finish creating the External Client App.
Flow Enablement section — JWT Bearer Flow enabled with the certificate uploaded
Figure 6: Flow Enablement section — JWT Bearer Flow enabled with the certificate uploaded, and Security settings below it.

Important: The certificate uploaded here must be the same certificate whose private key was exported into the .jks file in Part 2 — Salesforce uses it to validate the JWT signature sent by MuleSoft.

Part 4: Configure App Policies and OAuth Policies

After the app is created, its policies must be configured so that Salesforce knows which users/profiles the integration can act as, and how strictly to enforce authorization and IP restrictions.

4.1 OAuth Policies — Permitted Users and IP Relaxation

  1. Open the newly created External Client App and go to its Policies tab.
  2. Expand OAuth Policies.
  3. Under Plugin Policies, set Permitted Users to Admin approved users are pre-authorized.
  4. Under App Authorization, set IP Relaxation to Relax IP restrictions.
  5. Click Save.

4.2 App Policies — Profiles and Permission Sets

  1. Under Select Profiles, move System Administrator (or the appropriate integration profile) to Selected Profiles.
  2. Under Select Permission Sets, move SCRT2 Integration User to Selected Permission Sets.
  3. Click Save.
App Policies tab — selecting the System Administrator profile and the SCRT2 Integration User permission set
Figure 7: App Policies tab — selecting the System Administrator profile and the SCRT2 Integration User permission set.
OAuth Policies — Permitted Users set to "Admin approved users are pre-authorized" and IP Relaxation set to "Relax IP restrictions"
Figure 8: OAuth Policies — Permitted Users set to "Admin approved users are pre-authorized" and IP Relaxation set to "Relax IP restrictions".

Wait Time: After saving these policies, wait 3–5 minutes for the changes to propagate through Salesforce before attempting to authenticate from Anypoint Studio.

Part 5: Configure the JWT Connection in Anypoint Studio

With the External Client App created and its certificate uploaded, the final step is to configure the Salesforce connector in Anypoint Studio to authenticate using the OAuth JWT Bearer Flow.

In your Salesforce connector configuration, select OAuth JWT Bearer Flow and provide the following values:

ParameterWhere to find it / What to enter
Consumer KeyCopy from the External Client App's settings page (under API / Enable OAuth Settings).
KeystorePath to the .jks file downloaded in Part 2.
Store PasswordThe keystore password you set when exporting to the keystore in Part 2.
Certificate AliasThe name (label) of the certificate created in Part 1.
PrincipalThe Salesforce username the integration will run as (e.g. the System Administrator user).
Token Endpointhttps://login.salesforce.com/services/oauth2/token (use test.salesforce.com for sandboxes).
Audience URLhttps://login.salesforce.com (use https://test.salesforce.com for sandboxes).

Once all fields are filled in, click Test Connection to verify the setup.

Part 6: Test the Connection

  1. In Anypoint Studio, open the Salesforce connector configuration created above.
  2. Click Test Connection.
  3. A success message confirms that Salesforce accepted the signed JWT and issued an access token — the integration is now ready to use.

Troubleshooting: If the test fails, double-check that:

  • The certificate uploaded to the External Client App matches the alias/keystore used in Anypoint Studio.
  • The Principal user has the SCRT2 Integration User permission set and System Administrator profile assigned in App Policies.
  • You waited at least 3–5 minutes after saving App Policies before testing.

Summary

By completing the steps above, Salesforce and MuleSoft now trust each other through a certificate-based OAuth JWT Bearer Flow. Salesforce holds the public certificate on the External Client App, and MuleSoft signs authentication requests using the matching private key stored in the .jks keystore. This setup is headless, token-based, and does not require user interaction after the initial configuration — making it ideal for automated, server-to-server integrations.

Quick reference — end-to-end flow:

  1. Create self-signed certificate → Certificate and Key Management
  2. Export to Keystore → download .jks
  3. Create External Client App → Basic Info → Enable OAuth Settings → Flow Enablement (upload certificate)
  4. App Policies → assign Profile + Permission Set
  5. OAuth Policies → Admin approved users pre-authorized + Relax IP restrictions
  6. Wait 3–5 minutes
  7. Anypoint Studio → configure JWT connector (Consumer Key, Keystore, Password, Alias, Principal, Token Endpoint, Audience URL)
  8. Test Connection