Salesforce T4S Prerequisites
There are several Salesforce prerequisites you will need before you can configure the T4S package to work with your T4S Server.
Create a Salesforce Self-Signed Certificate.
It is recommended you use the Salesforce Org name within the certificate label, as you may need to install certs from different Salesforce Orgs into the single T4S Server.
It is also recommended that you select the cert key size as 4096-bit, as the cert will last for 2 years.
Create a Remote Site Setting of your T4S domain.
The new Salesforce remote site setting is required so the T4S package can connect out of Salesforce to the T4S Server
Create a Salesforce API Only integration user.
One option is to clone a profile such as the Administrator profile and set the following changes.
Password does not expire. (This is to stop API login attempts from failing due to expired passwords)
API Only
After development, you can further restrict the profile's security.
Another option is to use a Stanard profile, with permission sets to accomplish the above, while also giving the CRUD permissions to everything T4S requires in the Org.
Option to add your office network IP range to the Network Access Trusted IP Range.
This can help test access from inside your network without using the user's security token.