# Configuring ECA Authentication

## External Client Application (ECA) Authentication

To configure External Client Application (ECA) authentication, complete the following steps:

> [!IMPORTANT]
>
> Before you begin, install External Client Application from Salesforce AppExchange. For information, refer to [Installing External Client Application](<#installing-external-client-application>).

> [!NOTE]
>
> **Screenshot**
>
> [![External Client Application authentication](<https://documentation.sailpoint.com/connectors/salesforce/va/help/img/eca.png>)](<https://documentation.sailpoint.com/connectors/salesforce/va/help/img/eca.png>)

1. Turn on the **Enable External Client App (ECA)** toggle.
2. Under **Client configuration**, enter the required key-value pairs:

   1. In the **Key** box, enter the key as `host_name`.
   2. In the **Value** box, enter the **Token URL** to generate the token. For example: `test.salesforce.com` or `login.salesforce.com`.
3. Select **Save**.
4. Select **Authorise**.

> [!NOTE]
>
> - The **Human** account you use to authorise the ECA must have adequate permissions to manage the required Salesforce objects.
> - If you encounter issues with ECA authentication, you can turn off the feature and revert to your previous, working configuration.

### Important Considerations for Salesforce ECA Integration

**Maximum concurrent tokens:** Salesforce limits active refresh tokens to five per user for each External Client App (ECA) or Connected App. If you request a sixth connection, Salesforce automatically and silently revokes the oldest active token to accommodate the new request.

**Revoked token reuse:** If an authenticated source attempts to authenticate by using a previously revoked token (such as the silently dropped oldest token), Salesforce flags the attempt as a critical security threat. As a result, Salesforce immediately invalidates all active refresh tokens and sessions for that user across all clients. If this occurs, you must reauthorize the integration to continue.

### Installing External Client Application

Perform the following steps to install External Client Application:

1. Go to [SailPoint Identity Security for Salesforce](<https://appexchange.salesforce.com/appxListingDetail?listingId=a9038562-54ea-4fb9-9a92-38aa25cf66bb>) on AppExchange, and select **Get It Now**.
2. Enter your Salesforce credentials to authorize the installation.
3. Select the installation option that aligns with your organization's security requirements.

For more information on configuring External Client Application (ECA) authentication, refer to [External Client Application Authentication](<#external-client-application-eca-authentication>).