Getting Started
Overview
This guide walks you through connecting a Salesforce org to Britive and granting your first just-in-time access session to a Salesforce permission set — with no standing assignments and full audit logging on every checkout.
What you’ll accomplish:
- Create a Britive connected app in Salesforce with the required OAuth scopes
- Onboard the Salesforce application in the Britive console
- Create an access profile for a Salesforce permission set
- Check out and verify JIT access end-to-end
Prerequisites
Before you begin, make sure you have:
- A Britive tenant with administrator access
- Salesforce System Administrator access to create connected apps and permission sets
- A Salesforce org (Production, Sandbox, or Developer Edition)
Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.
How It Works
Britive uses a Salesforce Connected App with OAuth 2.0 to call the Salesforce REST API. At checkout, Britive assigns the target permission set to the requesting user. At checkin (or on expiry), the permission set assignment is removed — no standing elevated access remains.
User → Britive Console → Salesforce REST API → Permission Set Assignment (add/remove)Onboarding the Application
Connect your Salesforce org to your Britive tenant. This is a one-time setup performed by an administrator.
For detailed reference, see the Britive documentation.
Using the Britive Console
Create a Connected App in Salesforce
In Salesforce Setup, navigate to App Manager → New Connected App. Enable OAuth and add the required scopes. Set the callback URL to your Britive tenant’s OAuth callback.
Copy the Consumer Key and Secret
After saving, copy the Consumer Key (client ID) and Consumer Secret (client secret). Store the secret in the Britive Secrets Store.
Add the application in Britive
Navigate to Applications → Add Application → Salesforce. Enter your Salesforce org URL, Consumer Key, and Consumer Secret.
Authorize Britive
Complete the OAuth authorization flow in the Britive console to grant access to your Salesforce org.
Verify the connection
The application connection can be verified by Saving and Testing the configurations.
Initiate a Scan
Britive will scan and import your permission sets and profiles. Along with the entitlement information, Britive will also scan for all of the accounts present in the Salesforce instance. You can explore the scanned data by navigating to the Data tab on the application instance.
Create Your First Access Profile
Using the Britive Console
Open the Salesforce application
Navigate to Applications → select your Salesforce application → Profiles → Add Profile.
Configure the profile
| Field | Value |
|---|---|
| Name | A descriptive name (e.g., SF-DataExport) |
| Expiration | Set a max session duration (e.g., 4h0m0s) |
Select Associations
This is the environment where you would like to permission sets to be applied at checkout. Each profile can be associated to one or many Salesforce instances through associations.
Add permissions
Under Permissions, add the Salesforce permission sets to include in this profile.
Add a policy
Under Policies, assign members and configure approval or time-of-access conditions.
Save and activate
Click Save.
Verify
Check out the profile
Navigate to My Access → find your profile → click Check Out.
Confirm Salesforce access
In Salesforce, navigate to Setup → Users → find your user → Permission Set Assignments. Confirm the permission set appears.
Check in
Return to My Access → click Check In. Verify the permission set is no longer assigned to your user in Salesforce.
Troubleshoot
| Symptom | Likely Cause | Fix |
|---|---|---|
| Application shows “Disconnected” | OAuth token expired or revoked | Re-authorize in the Britive console |
| Permission sets not visible | Connected App lacks the api OAuth scope | Update the Connected App scopes and re-authorize |
| Checkout fails | User doesn’t exist in Salesforce | Ensure the Britive user email matches a Salesforce user’s login |