Create a connected app and authenticate

Updated Nov 8, 2026 · Based on Salesforce developer docs retrieved 2026-11-08

The Ingestion API is server-to-server, so it authenticates with OAuth through a connected app (a Salesforce record that represents your backend and issues it credentials) rather than a user login. You create the app, trade its credentials for a token in two hops, then send that token on every API call.

Create the connected app

1. From Setup, open App Manager and create a New Connected App.
2. Turn on Enable OAuth Settings.
3. Add the scopes your backend needs: cdp_ingest_api, api, and refresh_token/offline_access (see note below for what each covers).
4. Save, then open the app to copy its Consumer Key and Consumer Secret.

Exchange credentials for a Data Cloud token

Calling the Ingestion API takes two token requests, not one: first you get a standard Salesforce OAuth token for your org, then you exchange that for a Data Cloud-specific token the Ingestion API actually accepts.

1. 1 Connected app Consumer Key + Secret
2. 2 Org OAuth token JWT bearer grant
3. 3 Data Cloud token token exchange (a360)
4. 4 Ingestion API call Bearer header

1. Request an org access token from your org’s token endpoint (/services/oauth2/token) using the JWT bearer grant type.
2. From that response, keep the org access_token and instance_url.
3. Send a second request to the Data Cloud token-exchange endpoint (/services/a360/token), passing the org token as the subject_token.
4. From that response, keep the new Data Cloud access_token and tenant-specific instance_url — this is the token the Ingestion API expects.
5. Send that Data Cloud token as a Bearer header on every Ingestion API request.