Why does Salesforce show an unexpected error when connecting to Apptoto?

Salesforce blocks users from authorizing a connected app that has not been installed in their org. It stops the flow before showing the approval screen, so the only message you see is a generic one such as OAUTH_APPROVAL_ERROR_GENERIC: An unexpected error has occurred during authentication. The real reason appears only in the browser address bar, as error=invalid_client and error_description=app must be installed into org. A Salesforce administrator can fix it by attempting the Apptoto connection once and letting it fail, then going to Setup > Apps > Connected Apps > Connected Apps OAuth Usage, finding Apptoto in the list, and clicking Install. Then try connecting again. As an alternative, an administrator can assign the Approve Uninstalled Connected Apps permission to the person doing the connection.

If Salesforce Blocks the Connection

If Salesforce stops you on an error page instead of returning you to Apptoto, the usual cause is that the Apptoto app has not been installed in your Salesforce org.

Salesforce blocks this before it shows you the approval screen, so the page you land on is generic and unhelpful. It normally reads:

OAUTH_APPROVAL_ERROR_GENERIC: An unexpected error has occurred during authentication. Please try again.

Trying again does not help. The real reason appears only in the browser address bar, which contains error=invalid_client&error_description=app+must+be+installed+into+org. You can confirm it there, but you do not have to: if Salesforce shows you any error instead of bringing you back to Apptoto, the steps below are the fix to try first.

This is a Salesforce security setting, not an Apptoto problem. Salesforce no longer lets a user approve an app on their own unless an administrator has installed it. Salesforce connections made before this restriction was introduced keep working, so this usually appears the first time someone in your org connects Salesforce to Apptoto.

Install the Apptoto app (recommended)

A Salesforce administrator can do this in a few minutes.

Let the connection fail once - Attempt the Apptoto connection and let Salesforce block it. This step is required: the denied attempt is what makes Apptoto appear in the list in the next step.
Open Connected Apps OAuth Usage - In Salesforce, go to Setup > Apps > Connected Apps > Connected Apps OAuth Usage.
Install Apptoto - Find Apptoto in the list and click Install.
Connect again - Return to Apptoto and connect Salesforce. The connection now completes normally, for everyone in your org.

Grant the permission instead

As an alternative, a Salesforce administrator can assign the Approve Uninstalled Connected Apps permission to the person making the connection. Salesforce System Administrators already have this permission, which is why an administrator connecting their own Salesforce account often succeeds without installing the app first.

Installing the app is the better option. It applies to everyone in your org, and it does not depend on a permission that Salesforce is steering customers away from.

If you are still blocked after trying both, contact Apptoto Support.

Once the connection goes through, pick up the rest of the setup in Connecting Salesforce.