If you’ve enabled or plan to enable Salesforce API Access Control, follow these steps to ensure your Backstory products continue to work as expected.
When API Access Control is enforced, users can only access Salesforce APIs through connected apps you’ve allowlisted. Any Backstory app that isn’t allowlisted stops working for your users.
Identify the Backstory Connected Apps in Your Org
As part of your Backstory onboarding, your team installed the relevant connected apps and external client apps in your Salesforce org. Review the list below to identify the Backstory apps installed in your org. You’ll need to configure an access policy and assign users for each app.
Engagement Dashboards and Activity Sync
Salesforce name: Backstory Integration App
App type: Connected App
Purpose: Provides system access through the Backstory integration user.
Backstory App (formerly PeopleGlass)
Salesforce name: PeopleGlass
App type: Connected App
Purpose: Provides user access to Backstory Sheets.
PeopleGlass Client
Salesforce name: PeopleGlass Client
App type: External Client App
Purpose: Used when the PeopleGlass package is installed.
Note: Only applies if your org has the PeopleGlass package installed.
Backstory Embedded Experience
Salesforce name: Depends on your org’s identity provider configuration:
Identity Provider Initiated: Backstory: Canvas App or People.ai: Canvas App
Service Provider Initiated (SPI): Backstory: Canvas App (SPI) or People.ai: Canvas App (SPI)
App type: Connected App (Canvas)
Purpose: Displays Backstory views within Salesforce.
Important: Both versions are installed in your org, but only one is active at a time. Installing both is safe and avoids having to determine which version is active.
ClosePlan
Salesforce name: The name assigned when the app was created, usually ClosePlan.
App type: Connected App or External Client App
Purpose: Makes metadata and UI API calls from within Salesforce through a named credential. External access isn't required.
Activate API Access Control in Your Org
Note: Activating and configuring API Access Control requires Salesforce administrator access.
Check whether an API Access Control page already exists in Setup. If it does, API Access Control is already activated in your org.
If it isn’t activated yet, ask Salesforce to activate it by submitting a request through Restrict Access to APIs with Connected Apps.
Open the API Access Control page in Setup once it appears. Do not select API Access Controls (plural), which contains GraphQL API settings.
Review the three options and configure them as needed. Most customers select For admin-approved users, limit API access to only allowlisted connected apps rather than For customers and partners, limit API access to only installed connected apps, since these options are mutually exclusive. The Allow Visualforce pages to access APIs option is independent and can be configured separately.
Tip: Once API Access Control is activated in production, you can turn it on in a sandbox without a refresh. Navigate to Setup, select Company Information, and click Match Production Licenses.
Turning on the first option switches every connected app still set to All users may self-authorize to Admin approved users are pre-authorized and locks that setting. After that, only users whose profile or permission set is assigned to an app can use it, and if no users are assigned, nobody can. Before you turn this option on, set each Backstory app to Admin approved users are pre-authorized and assign the right profiles or permission sets, as described in the next section.
Allow the Backstory Connected Apps
Repeat these steps for each Backstory app you use. Every app gets the same policy setting, but each one needs different users assigned.
Backstory Integration App: assign to the Backstory integration user.
PeopleGlass: assign to every user who should have access to Backstory Sheets.
Backstory: Canvas App: assign to all Salesforce users (recommended). Access to Backstory views is still controlled in Backstory, so assigning all users just means anyone without Backstory access sees a message from Backstory instead. Users who aren’t assigned to the canvas app hit Salesforce’s default error handling, which can redirect their browser away from the page.
ClosePlan (if you use ClosePlan): assign to the user who authorized ClosePlan’s named credential.
Tip: A dedicated permission set per app is easier to maintain than profiles.
The steps depend on whether the app is installed as a connected app or an external client app.
If the App Is a Connected App
For connected apps, set the policy and assign users in two separate places.
Important: The policy change in step 3 below takes effect immediately, so nobody can use the app until you complete step 5. Complete these steps in one sitting, or plan a short maintenance window.
In Setup, enter “Connected Apps” in Quick Find and select Manage Connected Apps.
Click the app name, then click Edit Policies.
Under OAuth Policies, set Permitted Users to Admin approved users are pre-authorized.
Click Save.
On the same app page, click Manage in the Profiles and Permission Sets related lists, which are now available, and add the users listed above.
If the App Is an External Client App
For external client apps, you set the policy and assign users in the same edit, so users don’t lose access in between.
In Setup, enter “External Client App Manager” in Quick Find and select it.
Click the app name, open the Policies tab, and click Edit.
Under OAuth Policies, set Permitted Users to Admin approved users are pre-authorized.
Scroll up to App Policies and select the profiles or permission sets listed above.
Click Save.
Enable the API Access Control Restriction
Important: This affects every connected app in your org, not just Backstory’s. Enabling the restriction switches any app still set to All users may self-authorize to Admin approved users are pre-authorized and locks it with no users assigned, so those apps stop working for everyone. Before you continue, review every connected app in your org and set up access for the ones your users need. Complete the steps below only after you’ve done that and verified that every Backstory app works.
In Setup, enter “API Access Control” in Quick Find and select API Access Control.
Click the For admin-approved users, limit API access to only allowlisted connected apps toggle to enable it.
Click Save.
The restriction takes effect immediately, and users can access Salesforce APIs only through the allowlisted apps they’re assigned to. To roll back, turn the restriction off on the same page. Apps that were switched automatically return to their original Permitted Users setting, but apps you set to admin-approved yourself, including the Backstory apps, keep that setting and their user assignments.
Frequently Asked Questions
A user or Backstory feature stopped working after these changes. What should I check?
Once an app is set to Admin approved users are pre-authorized, only users whose profile or permission set is assigned to it can use it, whether or not API Access Control is enforced. Check that the user is assigned to the correct app, and remember to do the same for every new Backstory Sheets user.
Can I grant Use Any API Client instead?
We don’t recommend it. That permission bypasses API Access Control for the user, including for apps you intend to restrict. If a user needs broader access, grant it through a separate, time-limited permission set instead.
Do I need Salesforce administrator access to complete these steps?
Yes. Allowlisting connected apps and enabling API Access Control both require Salesforce administrator access.
What happens if I enable the restriction before allowlisting Backstory’s apps?
Every Backstory app still set to All users may self-authorize is switched to Admin approved users are pre-authorized with no users assigned, so it stops working immediately. Allowlist and assign users to each Backstory app before you enable the restriction.
Can I turn on API Access Control in a sandbox?
Yes. If it’s already activated in production, navigate to Setup, select Company Information, and click Match Production Licenses to turn it on in your sandbox without a refresh.
Need Help?
Contact your Customer Success Manager or support@backstory.ai.