GeezerVison

Summary

Follow-up to #6508. Verified the Salesforce integration-user guide against Salesforce's current UI and first-party docs before we point a customer at it. Most of it holds; four things do not, and one of them is the likeliest way a JWT setup fails.

• The Client Credentials step pointed at the wrong screen. It told admins to check Enable Client Credentials Flow under OAuth Policies. On an External Client App that checkbox is under Edit Settings → OAuth Settings; the Policies page holds only the Run As picker. Anyone following it literally hunts for a control that isn't there. The FAQ answer inherited the same conflation.
• Pre-authorizing the app must go through the profile or a second permission set. A permission set backed by the Salesforce API Integration license cannot hold an Assigned Connected Apps section at all (KB 001453686), so the app can never be assigned from the same permission set that grants object access — producing exactly the user hasn't approved this consumer failure that step exists to prevent.
• RSA ≥2048 only. An ECDSA key is silently rejected, and the uploaded certificate must stay under 4 KB.
• The JWT toggle doesn't appear until Enable OAuth is on, and the upload control is Upload Files.

Also scopes the capability promise for the API-only license, so we don't advertise something untested:

• SOQL and CRUD on standard objects — supported.
• Reports and dashboards — genuinely unverified in either direction from first-party docs. Flagged as needing a sandbox test rather than asserted.
• Apex Class Access is a permission this license cannot hold, so Tooling API calls touching ApexClass will fail. Custom field/object management is unaffected.

Verified as accurate and left alone: External Client App is the right object, Connected App creation is disabled org-wide since Spring '26, the openssl command and a 10-year self-signed cert are fine, the My Domain formats are current post-Enhanced-Domains, and "Admin approved users are pre-authorized" is the verbatim current label.

Type of Change

• Documentation

Testing

fumadocs-mdx + tsc --noEmit clean, biome clean, MDX component nesting balanced and the FAQ block still parses.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)