This guide shows you how to connect your Salesforce org to Sweep using your own External Client App (ECA). It has three parts:

Create your External Client App in Salesforce
Create a dedicated integration user (optional, see below)
Connect Sweep using that app, so the scan can start

Part 1: Create your External Client App

Step 1: Create the app

In Setup, type External Client App Manager in Quick Find and open it.
Click New External Client App.

Basic Information

Field	What to enter	Notes
External Client App Name	Sweep Integration	Any name works. It's shown on the login approval screen.
API Name	Sweep_Integration	Fills in automatically
Contact Email	Your admin email
Distribution State	Local

API (Enable OAuth Settings)

Check Enable OAuth, then set:

Setting	What to do
Callback URL	`https://app.sweep.io/salesforce-oauth2-redirect`
OAuth Scopes	Add both: • Manage user data via APIs (api) • Perform requests at any time (refresh_token, offline_access)
Flow Enablement	Leave everything unchecked
Security	Check: • Require secret for Web Server Flow • Require secret for Refresh Token Flow • Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows Leave Enforce Refresh Token IP Allowlist unchecked unless your security policy requires it. If it does, allow Sweep's IP: 52.207.71.182
SAML, Canvas, Mobile, Push Notification and Notification settings	Leave unchecked

Click Create.

Step 2: Copy the Consumer Key and Secret

On the app's detail page, open the Settings tab.
Scroll to OAuth Settings and click Consumer Key and Secret.
Salesforce opens a new tab and emails you a verification code. Enter it.
Copy both values somewhere safe:
- Consumer Key → this is your Client ID in Sweep
- Consumer Secret → this is your Client Secret in Sweep

Part 2: Create a dedicated integration user (optional)

Which user should connect Sweep? The Salesforce user that connects Sweep through your External Client App needs at least the permissions listed in Step 8. You can either:

Use a System Administrator. Admins already have these permissions, so you can skip Part 2.
Create a dedicated integration user. If your organization prefers a user with only the minimum permissions, follow Part 2 to create one from scratch.

Before you start this part, make sure you have:

One free Salesforce Integration user license. Check in Setup → Company Information → User Licenses. Enterprise, Unlimited and Performance editions include 5 at no cost.
An email inbox you can access for the integration user. You'll need it to set the user's password and receive verification codes.

Step 3: Create an integration profile

In Salesforce Setup, type Profiles in Quick Find and click Profiles.
Click New Profile.
For Existing Profile, select Minimum Access - API Only Integrations.
For Profile Name, enter Sweep Integration Profile.
Click Save.

The user license (Salesforce Integration) is set automatically by the profile you cloned. You don't need to pick it here.

Step 4: Confirm API access is enabled

On the new profile, click Edit.
Under Administrative Permissions, make sure API Enabled is checked.
Click Save.

Step 5: Add or create the integration user

In Setup, go to Users → Users and click New User.
User License: Salesforce Integration
Profile: The profile you created above
Click Save.

Step 6: Assign the permission set licenses

On the integration user's detail page, scroll to Permission Set License Assignments and click Edit Assignments.
Check Salesforce API Integration.
Only if Salesforce CPQ is installed, also check Salesforce CPQ License and Salesforce CPQ AA License.
Click Save.

Step 7: Create a permission set for Sweep

In Setup, type Permission Sets in Quick Find and click Permission Sets.
Click New.
For Label, enter Sweep Integration Permissions.
Leave License set to --None--.
Click Save.

Step 8: Add the required permissions

These permissions let Sweep read your org's full configuration and data model so the scan is complete. In the permission set, open System Permissions, click Edit, check each permission below, and click Save. Then open App Permissions and do the same.

Section	Permission to check
System Permissions	• Modify Metadata Through Metadata API Functions • View Roles and Role Hierarchy • View Setup and Configuration • Customize Application • Manage Custom Permissions • Manage Profiles and Permission Sets • Approve Uninstalled Connected Apps • Manage Sharing • View All Data (automatically adds View Event Log Files, View Dashboards in Public Folders, View Reports in Public Folders) • Manage Reports in Public Folders (automatically adds View Reports in Public Folders, Create Report Folders, Edit My Reports)
App Permissions	• Manage Flow

Step 9: Assign the permission set to the integration user

On the Sweep Integration Permissions permission set, click Manage Assignments.
Click Add Assignment.
Select the Sweep Integration user, click Next, then click Assign.

Part 3: Connect Sweep

Step 10: Add the environment in Sweep

Log in to Sweep and go to Environments.
Click Connect New and choose Salesforce.
Choose the environment type: Production, Sandbox or Development.
Check Use my own External Client App.
Paste the Client ID (Consumer Key) and Client Secret (Consumer Secret) from Step 2.

Step 11: Log in and approve access

Click Connect. A Salesforce login window opens.
Log in with the integration user's username and password (or your own admin login, if you skipped Part 2).
If Salesforce asks for a verification code, check the integration user's email inbox.
Click Allow to approve access.
Wait for the window to close. Your environment now shows as Connected, and Sweep starts scanning your org.

How to Connect Your Salesforce Org to Sweep