Set up JDBC with External Client Apps

With the Data 360 Java Database Connectivity (JDBC) driver, you can access and retrieve data from Data 360 by using tools that support JDBC and Data 360 SQL. Use this document to learn about setting up and configuring the Data 360 JDBC driver with External Client Apps.

Important: As of February 21, 2026, you can no longer create Connected Apps. Use External Client Apps (ECAs) instead. ECAs support the OAuth 2.0 JWT Bearer Flow for JDBC connections. Username-Password Flow and Refresh Token Flow are not supported with ECAs.

Prerequisites

Before connecting to Data 360 with the JDBC driver:

Required Permissions:

To create an External Client App and connect JDBC, see the user permissions table in Create an External Client App.
To use your External Client App in a non-default data space, associate the chosen permissions set with the data space. For more information, see Salesforce Help: Associate a Permissions Set with a Data Space.

Before You Begin: Generate a Key Pair and Certificate

Open a terminal or command prompt and run these commands:

1# Create a private and public key pair
2openssl genrsa -out keypair.key 2048
3
4# Create a self-signed digital certificate (provide your country, state, and organization when prompted)
5openssl req -new -x509 -nodes -sha256 -days 365 -key keypair.key -out certificate.crt
6
7# Create a PKCS#8 private key (compatible with the JDBC driver)
8openssl pkcs8 -topk8 -nocrypt -in keypair.key -out private.key

You now have three files, each used at a different point:

keypair.key: The input for generating certificate.crt and private.key.
certificate.crt: Upload this to the External Client App in Step 2.
private.key: Provide this when you configure your JDBC connection. See Driver URL and Properties.

Step 1: Create the External Client App

From Setup, enter External Client App Manager in the Quick Find box, then select External Client App Manager under Apps → External Client Apps.
Click New External Client App.
Fill in the required fields:

External Client App Name: A display name for your app (for example, “Data 360 JDBC Connection”)
API Name: Auto-fills from the display name
Contact Email: Your email address
Distribution State: Leave as Local

Don’t click Create yet. Continue to the next step to enable OAuth.

Step 2: Enable OAuth and Configure JWT Bearer Flow

On the same form from Step 1:

Expand the API (Enable OAuth Settings) section.
Check Enable OAuth. The OAuth configuration fields appear.
Under App Settings:

Callback URL: Enter any valid URL (for example, http://localhost:55555). The callback URL is required for JWT Bearer authentication, even though it isn’t used at runtime.
OAuth Scopes: In the Available OAuth Scopes list, click each of the following scopes, then click the right-arrow ▶ to move them to Selected OAuth Scopes:
- Manage user data via APIs (api)
- Perform SQL queries on Data Cloud data (cdp_query_api) — Scroll the Available list to find this scope.
- Perform requests at any time (refresh_token, offline_access)

Under Flow Enablement, check Enable JWT Bearer Flow. A Certificate Upload widget appears directly below the checkbox.
In the Certificate Upload widget, click Upload Files and select the certificate.crt file you generated in Before You Begin.

Note: Upload only the certificate.crt file here. You’ll use the private.key file later when configuring your JDBC connection.

Leave the Security defaults as-is (PKCE and Require secret are fine for JWT Bearer Flow).
Click Save at the bottom of the form.

After you save, you land on the External Client App detail page. Before you can use the app, you need to configure who can authorize it.

Step 3: Configure OAuth Policies

After you save the External Client App, you configure which users are permitted to use it by editing the saved app.

In the External Client App. On the detail page, select the Policies tab, then click Edit.
Expand OAuth Policies if it isn’t already expanded.
Under Plugin Policies, set Permitted Users to “Admin approved users are pre-authorized”.
After you change Permitted Users, additional fields appear for selecting profiles and permission sets. Under Select Profiles, choose the permitted profile or, under Select Permission Sets, choose the permitted permission set. Do not choose both.
Click Save.

Step 4: Retrieve the Consumer Key

The Consumer Key (also called Client ID) is required for JDBC authentication.

Go back into your saved External Client App and open its OAuth settings.
Copy the Consumer Key value. You’ll use this as the clientId property when connecting with the JDBC driver.

Note: The Consumer Secret is not required for JWT Bearer Flow authentication. You need only the Consumer Key (clientId) from the app.

Driver URL and Properties

Configure the driver by using a connection URL combined with Java properties. The URL format is jdbc:salesforce-datacloud://<Salesforce Domain Name>.

For the JWT Bearer Flow with External Client Apps, use the Salesforce login domain name: jdbc:salesforce-datacloud://login.salesforce.com. You can use login.salesforce.com instead of your organization-specific My Domain address (such as mycompany.my.salesforce.com).

During connection setup, provide these properties for JWT Bearer Flow authentication:

Required Properties for JWT Bearer Flow

clientId: Consumer Key from your External Client App
privateKey: Contents of the private key file (private.key) in PEM format
userName: Username for the account

Note: The clientSecret (Consumer Secret) is not required for JWT Bearer Flow authentication.

Optional Properties

dataspace: Data Space for queries. Default: default.
maxRetries: Number of authentication request retries. Default: 3.
User-Agent: This value identifies your application and can help Salesforce Support with debugging. It must be a valid product component as defined in RFC7231, including a version component. Format: salesforce-datacloud-jdbc/version.

Next Steps

Now that you’ve configured your External Client App and have your Consumer Key and private key, you’re ready to connect.

Connecting from DBeaver? In DBeaver, leave the password field blank and use only the username. You’ll provide the clientId from your External Client App. The clientSecret is not needed for JWT Bearer Flow.