Org setup for admins

This page is for Salesforce admins. Template authors do not need it: once it is done, they only enter the org address, as in Connect to Salesforce.

There are two required steps, done once per org:

1. Install the Sliick Docs package and assign authors the right permission set.
2. Turn on Enable CORS for OAuth endpoints in Setup.

That is all. The package ships its own External Client App, so there is nothing to create and no consumer key to hand out. Do it in every org authors connect to: a sandbox and production are set up separately.

Step 1: Install the package and assign the permission set

The add-in reads your org’s fields and saves templates through the Sliick Docs managed package, so it cannot do anything until the package is installed. See Install and permission sets. Installing the package also:

• adds https://office.sliick.com, the add-in’s address, to your org’s CORS allowed origins list; and
• installs the Sliick Docs Integration External Client App, which the add-in signs in through by default.

Assign authors Sliick Docs Template Author (or Sliick Docs Admin for the people who own document policy). The package ships more than one permission set, and the wrong one fails late: Sliick Docs User is generation-only. An author with only that set can browse every object and field and build a complete template, and is refused only when they press Save, because saving a template needs more access than reading one. The pane explains the refusal in plain terms, but it is much cheaper to assign the right set up front.

Step 2: Enable CORS for OAuth endpoints

This is the step most often missed, and the package cannot do it for you.

The add-in signs in directly from Word to your org, with no Sliick server in between. That keeps the sign-in on the author’s own connection and out of Sliick’s infrastructure, but it means your org has to let its sign-in (OAuth) endpoints answer a request from the add-in’s web address. That permission is a Salesforce setting called Enable CORS for OAuth endpoints. It is off in a new org, and a package cannot turn it on, so an admin has to.

Do this:

1. In Setup, search for and open CORS.
2. Click Edit and tick Enable CORS for OAuth endpoints.
3. Click Save.

Then check, but do not add: on the same page, the Allowed Origins List should already contain https://office.sliick.com, because the package installs it. If it is genuinely missing, click New and add exactly this, with no path and no trailing slash:

https://office.sliick.com

What it looks like when this is missing. The author enters the org address, the Salesforce login window opens, they sign in and approve access, and then the pane reports “Can’t reach Salesforce.” The login worked; the final step of the sign-in was blocked by the org. Tick the box and have the author try again. Nothing else needs to change.

Note: this step is needed whichever app the add-in signs in through, including your own External Client App (see the optional step below). Turning the setting on when it is already on does no harm, so if you are unsure, check it.

Recommended: review the app’s policies

The packaged app arrives with sensible defaults, and you stay in control of it. In Setup, open External Client App Manager, then Sliick Docs Integration, then Policies. Both policies below apply to this app only; neither changes your org-wide login policy.

• Permitted Users. All users may self-authorize lets any licensed author connect. If you choose Admin approved users are pre-authorized instead, you must also assign a permission set or profile to the authors who should connect. Until you do, their sign-in is refused.
• IP Relaxation. Set it to Relax IP restrictions, and leave the refresh token IP allowlist and IP enforcement options off for this app. Authors sign in from wherever they work, so the sign-in arrives from any IP address. With IP restrictions enforced, Salesforce blocks it outright with “ip restricted by app developer”. Security is still enforced by the standard Salesforce login and the secured sign-in flow the add-in uses (PKCE).

This is also where you revoke the add-in’s access to the org entirely, should you need to.

Tell your authors to connect

There is nothing to distribute. Authors open the add-in, choose Connect to Salesforce, enter your org’s My Domain address (for example https://yourcompany.my.salesforce.com), and sign in as themselves. They see only the objects and fields their own Salesforce permissions allow.

The address is stored in the browser Word runs the add-in in, so it is entered once per computer, not once per person. An author using Word on the web as well as Word on the desktop enters it in each.

Optional: use your org’s own External Client App

Skip this unless your org’s policy requires connections to run through an app you created yourself. The packaged app covers the normal case.

In Setup, open External Client App Manager and click New External Client App (in older orgs, App Manager and New Connected App). Configure:

• Basic information
  • Name: Sliick Office Add-in, or anything you like
  • Contact email: your admin email
  • Distribution state: Local
• OAuth settings: tick Enable OAuth, then
  • Callback URL: https://office.sliick.com/auth-callback.html
  • OAuth scopes: both Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access)
  • Require Proof Key for Code Exchange (PKCE): on
  • Require secret for Web Server Flow: off
  • Require secret for Refresh Token Flow: off

Paste the callback URL exactly, including .html. Salesforce matches it character for character, and without the extension the sign-in fails before the login window comes back.

The two Require secret boxes must be off because the add-in runs in the browser and holds no secret; PKCE secures the flow instead. Leaving either one on fails sign-in with “invalid_client: invalid client credentials”.

Save the app. Salesforce generates a Consumer Key. Set its policies as described above, then give the key to your authors: in the add-in’s ⚙ Settings, under Advanced, they paste it into External Client App consumer key. The consumer key is a public identifier, not a secret, so it is safe to share. Leaving the box blank uses the packaged app.

Remember that Enable CORS for OAuth endpoints (Step 2) is still required with your own app.