Create a Connected App

• open Setup and type "App Manager" in the search box
• click App Manager
• in the top right, click New Connected App
• enter "Ofca Integration" as the name of the app and an Email address that you have access to
• check the box next to Enable OAuth Settings 
• enter "https://<domain>.my.salesforce.com" in the Callback URL (replace <domain> with your Salesforce My Domain)
• select the following OAuth Scopes:
  • Access the identity URL Service (id, profile, emal, address, phone)
  • Manage user data via APIs (api)
  • Manage user data via Web browsers (web)
  • Perform requests at any time (refresh_token, offline_access)
• make sure that the following options are selected
  • Require Secret for Web Server Flow    
  • Require Secret for Refresh Token Flow
  • Enable Client Credentials Flow

• in the Custom Connected App Handler section, set Run As to the user you created previously

• click Save
• click Manage Consumer Details 

• send the Consumer Key and Consumer Secret values to salesforce@ofca.io

• go back to the Connected App and click Manage

• click Edit Policies

• in the OAuth Policies section, set Permitted Users to Admin approved users are pre-authorized

• in the Client Credentials Flow section, set Run As the user you created previously

• click Save
  
• scroll down and click Manage Profiles

• check the box next to Minimum Access - API Only Integrations
  

• click Save