Skip to content

Headless 360 setup guide

By the end of this guide an external AI tool can work with ChargeOn payments, with every payment still confirmed by a person.

Who does this: a Salesforce administrator, with a security administrator's help for one step. How long: about an hour.

Complete the prerequisites first

Everything in the Headless 360 prerequisite guide, and in particular the confirmation from Cyntexa that Headless 360 is switched on for your org. Without it, the steps below will complete and the connection will still fail.

What you will do

  1. Turn on the Headless 360 setting
  2. Activate the server and copy its address
  3. Create an External Client App
  4. Generate the credentials
  5. Connect your AI tool
  6. Give users their permission
  7. Try a payment

Part 1 — Turn on the Headless 360 setting

  1. Go to Setup → Custom Settings.
  2. Find Integration API Settings and click Manage.
  3. Click New, or Edit if a record already exists.
  4. Tick MCP API Enabled.
  5. Click Save.

What you should see: the setting saved with the box ticked.

This is one of two switches

This setting is the half you control. The other half is Cyntexa switching Headless 360 on for your org, covered in the prerequisite guide. Both must be on. If you skipped the prerequisite, stop here and sort that out first — everything below will appear to work and then fail at the final step.

Part 2 — Activate the server and copy its address

  1. Go to Setup and search for MCP Servers.
  2. Open the ChargeOnMCP server.
  3. Click Active.
  4. Copy the server address and save it somewhere secure. You will need it in Part 5.

Copy the address now

You cannot complete the connection without it, and going back for it later is more awkward than it should be.

What you should see: the server showing as active, and its address saved.

Part 3 — Create an External Client App

This is what lets your AI tool authenticate to Salesforce. You may need a security administrator for this step.

  1. Go to Setup and search for External Client Apps.
  2. Click New External Client App.
  3. Fill in the basic information — a name and description that will mean something to whoever reads it in a year.
  4. Scroll to OAuth Settings on the same page.
  5. Fill in the OAuth details and the permission scope.
  6. In Callback URL, enter the callback address your AI tool requires. For Claude this is https://claude.ai/api/mcp/auth_callback.
  7. Tick the security options you are prompted for.
  8. Click Create.

The callback address must match exactly

Any difference at all — a trailing slash, a capital letter — makes authentication fail, and the resulting error will not tell you that the address is why.

What you should see: the app created and listed.

Part 4 — Generate the credentials

  1. Open the app you just created.
  2. Go to the Settings tab.
  3. Expand OAuth Settings.
  4. Click Consumer Key and Secret.
  5. Verify your identity if prompted.
  6. Copy both values and store them securely.

Store these properly, now

These are org access credentials. Put them in a password manager. Not an email, not a spreadsheet, not a chat message. You will not be shown them in full again.

What you should see: both values saved somewhere secure and shareable only with the people who need them.

Part 5 — Connect your AI tool

The exact steps depend on the tool. In Claude:

  1. Sign in at claude.ai.
  2. Open Settings from your profile.
  3. Go to Connectors.
  4. Click Add, then Add Custom Connector.
  5. Fill in:
  6. Remote MCP Server URL — the address from Part 2
  7. OAuth Client ID — the consumer key from Part 4
  8. OAuth Client Secret — the consumer secret from Part 4
  9. Click Add, then Connect.
  10. Sign in to Salesforce when redirected, and verify your identity if asked.
  11. Click Allow, then Always Allow.

What you should see: the connector showing as connected.

Part 6 — Give users their permission

Each person who will connect needs the ChargeOn MCP integration permission on their own user.

  1. Go to Setup → Users and open the user.
  2. Open Permission Set Assignments and click Edit Assignments.
  3. Add the ChargeOn MCP integration permission.
  4. Click Save.
  5. Repeat for each person.

Also confirm each of them has the ordinary ChargeOn permission sets for the operations they should be able to perform. Connecting and transacting are two different permissions.

What you should see: each user holding both the MCP permission and their ChargeOn operational permissions.

Part 7 — Try a payment

  1. Open a new conversation in your AI tool.
  2. Ask it to take a payment.
  3. Follow its questions.
  4. Confirm when asked.
  5. Check Transaction History in Salesforce for the resulting transaction.

What you should see: a transaction in ChargeOn, identical to one taken any other way.

A person always confirms

Headless 360 never completes a payment on its own. Every payment is shown for review and needs explicit confirmation before it executes. Repeating a request does not charge twice.

If something went wrong

Symptom Likely cause What to do
The connector will not connect Headless 360 is not switched on for your org yet Prerequisite guide, Part 1. This is the most common cause, and the error will not say so. Your Cyntexa account executive or support can confirm
Authentication fails after the Salesforce login The callback address does not match exactly Part 3, step 6. Compare character by character
A user connects but every request is refused They lack the ChargeOn MCP integration permission, or the operational permission sets Part 6. Both are needed
You cannot find MCP Servers in Setup The feature is not available in your org Confirm with your Salesforce account executive
You lost the consumer secret It is not shown again in full Generate a new one from the app, and update the connector with it
It cannot find a payment method The customer has none saved It cannot create one. Save it in Salesforce first