Connecting your Salesforce org to Delekit

Who this is for Your Salesforce administrator. The whole process takes about 15 minutes and is done entirely inside your own Salesforce org. Delekit never asks for your Salesforce username or password.

Before you begin

Salesforce restricted the creation of new Connected Apps in the Spring '26 release. External Client Apps are the replacement, and they are what these instructions cover. If you have an existing Connected App you would prefer to reuse, that will still work. Let us know and we'll confirm the settings we need.

You'll need:

• System Administrator access to the Salesforce org
• The callback URL supplied by your Delekit contact
• A list of the Salesforce objects and fields you want Delekit to read

Step 1: Create the External Client App

1. From Setup, enter App Manager in the Quick Find box and select it.
2. Click New External Client App.
3. Complete the basic information:

Set the Distribution State to Local. This keeps the app inside your own org. Packaged is only used when an app is being distributed to other Salesforce orgs, which doesn't apply here.

Step 2: Configure the OAuth settings

1. Open the API (Enable OAuth Settings) section and tick Enable OAuth.
2. In Callback URL, enter the URL supplied by your Delekit contact. It must be HTTPS.
3. Under Selected OAuth Scopes, add:
   • Manage user data via APIs api
   • Perform requests at any time refresh_token, offline_access
4. Tick Require Secret for Web Server Flow.
5. Leave Require Proof Key for Code Exchange (PKCE) enabled.
6. Click Create.

Salesforce can take up to 10 minutes to propagate a newly created app. If the credentials don't work immediately, wait and try again before troubleshooting.

Step 3: Set the OAuth policies

In an External Client App, policies are configured separately from settings. This is the main difference from the older Connected App screens.

1. Go to Setup → External Client App Manager and select Delekit Integration.
2. Open the Policies tab, then expand OAuth Policies.
3. Set the following:

If you selected Admin approved users are pre-authorised, you also need to assign the relevant Profile or Permission Set to the app before anyone can authorise it.

Step 4: Retrieve the Consumer Key and Secret

1. In External Client App Manager, select Delekit Integration.
2. Open the Settings tab and expand OAuth Settings.
3. Under App Settings, click Consumer Key and Secret.
4. Verify your identity using the code Salesforce emails to the contact address on the app.
5. Copy both values somewhere secure.

Step 5: Check the integration user's permissions

The Salesforce user account that authorises the connection must have:

• API Enabled on their Profile or via a Permission Set
• Read access to every object and field listed in Step 6

We recommend using a dedicated integration user rather than a named individual, so the connection survives staff changes.

Step 6: Add the credentials in Delekit

You enter these directly in the Delekit platform. Nothing needs to be emailed to us, and the Consumer Secret never travels by email.

1. Log in to Delekit.
2. Go to Organisation Edit → Integrations.
3. Select Salesforce.
4. Complete the following and save:

5. Click Connect. You'll be redirected to Salesforce to log in and approve access, then returned to Delekit.

Once connected, tell your Delekit contact which objects and fields you want us to read, using API names rather than display labels. For example, Contact: FirstName, LastName, Email, Job_Title__c.

A note on the secret Because you enter the Consumer Secret yourself, no one at Delekit ever needs to see it. It is stored encrypted and used only to request access tokens from your org.

Still stuck? Reply to this article or contact your Delekit account manager and we'll walk through it with you on a call.