Migrating an Existing Integration with Salesforce.com to OAuth

If you already integrate to Salesforce CPQ, learn about Salesforce's new authentication scheme and the steps necessary to migrate to it.

 

Understanding the Migration

Do I need to migrate?

If you installed your integration before July 2026 following our standard instructions, yes. While the integrations between Epicor CPQ and the Salesforce system are stable and don't change often, this migration is required by salesforce.

Why should I migrate?

Salesforce is requiring all integrations like ours to move from an older form of authentication (username/password) to a more modern and secure authentication (client credentials). Learn more from salesforce.

Migration Steps

You should perform these steps in your sandbox first, and then with a successful update, apply the same changes to production.

A. Confirm Current Integration

First, confirm your existing integration is configured in your CPQ sandbox.

1. Log in to your Epicor CPQ "dev" environment as a CPQ administrator.
2. Browse to Admin > Integration Settings > Salesforce.
3. Note the URL of the salesforce sandbox listed: you'll log into that instance shortly.
4. Click Check Credentials.
5. You should see the message "Your Salesforce Credentials are Correct".

If you have problems, review "Step 1:  In Salesforce, Install the "Epicor CPQ for Salesforce Sales Cloud" package." on page 1

B. Confirm Current User Experience

Next, confirm your existing integration is working well as a user.

1. As a regular salesperson, log in to the salesforce sandbox you noted in step 3 above.
2. Create an opportunity and a CPQ-enabled quote, as shown in this document: "Quick Overview" on page 1
3. Make a note of the completed quote number: you'll compare this quote with another quote after these changes.

If you have problems, review "Step 1:  In Salesforce, Install the "Epicor CPQ for Salesforce Sales Cloud" package." on page 1

C. Update Salesforce Setup

With a confirmed existing integration that is working well, log in to your salesforce sandbox as an administrator and follow these steps to upgrade.

1. Edit the Connected App you created, usually called "Epicor CPQ".
   1. Add standard OAuth scope:
      • Manage user data via APIs (api)
      • Full access (full)
   2. Set Client Credentials Flow to:
      • Enabled
   3. Set Permitted Users to:
      • Admin approved users are pre-authorized
2. Create/assign a Salesforce permission set for the execution user:
   • API Enabled
   • Use Any API Auth / Use Any API Client Credentials Flow, if that license is available to you from salesforce.
   • Assign app access to the External Client App
3. Set the client credentials execution user / Run As user to the active Salesforce user you created when you set up this integration, usually named "Integration user. If you have problems when you set up this user, note the following:

   • The Run As user must be a Salesforce user, not an Epicor CPQ user.

   • If token returns no client credentials user enabled, the execution user has not yet been saved.

   • If token returns no valid scopes defined, add the standard api OAuth scope.

4. Save and confirm the token request to ensure it works.

5. Assign the following five permission sets to this Epicor CPQ user account:

   1. ApexRestServices

   2. ApiEnabled

6. Gather your domain URL:

   • Search the salesforce Admin menu for “my domain” to open the my domain settings.

   • Copy the URL shown to a safe place: you'll use later in the next section.

D. Update Epicor CPQ Setup

Log in to your epicor "DEV" environment as an administrator and follow these steps to upgrade.

1. Open Admin > Integration Settings > Salesforce.
2. Ensure Enable Salesforce Integration is enabled (checked).
3. Enable (check) the new setting Use Salesforce Client Credentials.
   Note that the Username, Password, and Token fields disappear: they are not used in client credentials mode.
4. Paste the Salesforce My Domain URL with the URL you copied in the previous section.
5. Note that the Salesforce Canvas App Consumer Key and Consumer Secret fields should already be filled with existing data. You do not need to change these fields.
6. Click Check Credentials.
   You should see the message "Your salesforce credentials are correct."

E. Repeat in Your Production Org

When successful, repeat these steps again in your production Epicor CPQ environment production Salesforce org.

Nothing to deploy in Epicor CPQ.
Note that the adjustments you're making in Epicor CPQ are not deployed: they are applied immediately to that specific instance. Learn more about deploying updates and how behaviors are deployed between orgs, but data (like these integration settings) are not.