Connecting your Salesforce org to Delekit

Who this is for Your Salesforce administrator. The whole process takes about 15 minutes and is done entirely inside your own Salesforce org. Delekit never asks for your Salesforce username or password.

Before you begin

Salesforce restricted the creation of new Connected Apps in the Spring '26 release. External Client Apps are the replacement, and they are what these instructions cover. If you have an existing Connected App you would prefer to reuse, that will still work — the settings below apply to both.

You'll need:

• System Administrator access to the Salesforce org
• The Delekit callback URL (fixed for all customers): https://app.delekit.com/Salesforce/Callback
• A list of the Salesforce objects and fields you want Delekit to read

Step 1: Create the External Client App

1. From Setup, enter App Manager in the Quick Find box and select it.
2. Click New External Client App.
3. Complete the basic information:

Set the Distribution State to Local. This keeps the app inside your own org. Packaged is only used when an app is distributed to other Salesforce orgs, which doesn't apply here.

Step 2: Configure the OAuth settings

1. Open the API (Enable OAuth Settings) section and tick Enable OAuth.
2. In Callback URL, enter exactly (no trailing slash): https://app.delekit.com/Salesforce/Callback
3. Under Selected OAuth Scopes, add:
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
   • Access unique user identifiers (openid)
4. Tick Require Secret for Web Server Flow and Require Secret for Refresh Token Flow.
5. Tick Require Proof Key for Code Exchange (PKCE).
6. Click Create.

All three scopes are required — Delekit requests api, refresh_token, offline_access and openid when it connects, and Salesforce will reject the authorisation if any is missing.

Salesforce can take up to 10 minutes to propagate a newly created app. If the credentials don't work immediately, wait and try again before troubleshooting.

Step 3: Set the OAuth policies

In an External Client App, policies are configured separately from settings. This is the main difference from the older Connected App screens.

1. Go to Setup → External Client App Manager and select Delekit Integration.
2. Open the Policies tab, then expand OAuth Policies.
3. Set the following:

If you selected Admin approved users are pre-authorised, you also need to assign the relevant Profile or Permission Set to the app before anyone can authorise it.

Step 4: Retrieve the Consumer Key and Secret

1. In External Client App Manager, select Delekit Integration.
2. Under Policies > App Authorization set Refresh token is valid until revoked = true
3. Open the Settings tab and expand OAuth Settings.
4. Under App Settings, click Consumer Key and Secret.
5. Verify your identity using the code Salesforce emails to the contact address on the app.
6. Copy both values somewhere secure.

Step 5: Check the integration user's permissions

The Salesforce user account that authorises the connection must have:

• API Enabled on their Profile or via a Permission Set
• Read access to every object and field listed in Step 6

We recommend using a dedicated integration user rather than a named individual, so the connection survives staff changes.

Step 6: Add the credentials in Delekit

You enter these directly in the Delekit platform. Nothing needs to be emailed to us, and the Consumer Secret never travels by email.

1. Log in to Delekit.
2. Go to Organisation → Integrations and select Salesforce.
3. In the Connected App credentials card, click Enter credentials and complete:

4. Click Save credentials. The card will show Configured with a masked key. Your Consumer Secret is stored encrypted and is never displayed again — to change it, simply enter the credentials again.
5. Click Connect an org. You'll be redirected to Salesforce to log in and approve access, then returned to Delekit, where the org shows as Connected.

You don't need to provide your My Domain or instance URL — Delekit discovers it automatically from Salesforce during the connection.

Once connected, tell your Delekit contact which objects and fields you want us to read, using API names rather than display labels. For example, Contact: FirstName, LastName, Email, Job_Title__c.

A note on the secret Because you enter the Consumer Secret yourself, no one at Delekit ever needs to see it. It is stored encrypted in Delekit's secrets store and used only to request access tokens from your org.

Troubleshooting

redirect_uri_mismatch / "redirect_uri must match configuration"
The Callback URL on your app doesn't exactly match. Confirm it is https://app.delekit.com/Salesforce/Callback (https, correct host, no trailing slash) and that the Consumer Key/Secret you entered belong to the same app that callback is registered on.

"Enter your Salesforce Connected App credentials before connecting an org"
Complete Step 6 first; the Connect an org button is unavailable until credentials are saved.

invalid_scope
One of the required OAuth scopes is missing. Re-check Step 2 (api, refresh_token / offline_access, and openid must all be selected).

Wrong environment / can't log in
Check the Salesforce environment choice in Step 6: sandbox orgs must use Sandbox; production and Developer Edition orgs use Production / Developer.

Still stuck? Reply to this article or contact your Delekit account manager and we'll walk through it with you on a call.