Salesforce guide for creating an OAuth app

Salesforce is a leading customer relationship management (CRM) platform that helps businesses of all sizes manage and grow their customer relationships. With the Salesforce CRM connector, you can easily connect your Salesforce account to Apideck and automate your customer relationship management workflows.

Important: Salesforce has replaced Connected Apps

Since Spring '26 (March 2026), Salesforce has replaced Connected Apps with External Client Apps for new OAuth integrations. New Connected Apps can no longer be created by default.

If you already have a Connected App, it will continue to work — no changes are needed. For new integrations, follow the External Client App steps below.

If your org has a requirement that only a Connected App can meet, re-enabling Connected App creation is a request to Salesforce Support.

Create your OAuth app

Go to the Salesforce Portal (https://login.salesforce.com) and sign in with your Salesforce account. If you are setting up a sandbox environment, use https://test.salesforce.com instead.

After you are logged in, navigate to Setup using the gear icon in the top-right corner. In the side menu, go to Platform Tools > Apps > App Manager.

Click the New External Client App button in the top right.

Basic Information

Fill in the following required fields under the Basic Information section:

External Client App Name: A name to identify the app, for example "Apideck". The name must be unique within your org.
API Name: A unique identifier used to refer to the app within Salesforce. This auto-fills from the app name.
Contact Email: The email address of the person responsible for the app.
Distribution State: Choose the Distribution State that fits how you intend to use the app. Salesforce's External Client Apps documentation explains what each option covers.

OAuth Settings

Expand the "API (Enable OAuth Settings)" section and check "Enable OAuth".

In the Callback URL field, enter https://unify.apideck.com/vault/callback
In the Selected OAuth Scopes field, move the following scopes to Selected:
- "Manage user data via APIs (api)"
- "Access unique user identifiers (openid)"
- "Perform requests at any time (refresh_token, offline_access)"
"Full access (full)" is also declared by the connector and may be selected in addition if your org prefers a broader grant, but api, openid and refresh_token must stay selected: Apideck requests exactly those three, and token refresh depends on refresh_token.

Note: Scope labels in External Client Apps may differ slightly from Connected Apps, but the scope values (shown in parentheses) are the same.

Flow Enablement

Check "Enable Authorization Code and Credentials Flow"
Leave "Require user credentials in the POST body" unchecked

Security

The Security section is where External Client Apps differ most from Connected Apps. Review each setting carefully:

Require secret for Web Server Flow: Leave checked (default)
Require secret for Refresh Token Flow: Uncheck this — Apideck handles token refresh without the client secret
Require Proof Key for Code Exchange (PKCE): Leave checked (default) — Apideck fully supports PKCE
Enable Refresh Token Rotation: Leave unchecked — Apideck stores refresh tokens; rotation would require updating the stored token on every refresh
Issue JSON Web Token (JWT)-based access tokens: Leave unchecked

When you are finished, click Create. It can take up to 10 minutes for the new app to become active.

Consumer Key & Secret

After creating your External Client App, you need to retrieve the Consumer Key and Secret to connect your Salesforce account to Apideck.

After creation, you will land on the Manage External Client Apps page (Policies tab)
Click the Settings tab (this navigates to a separate page)
Scroll to the OAuth Settings section
Click the "Consumer Key and Secret" link
Copy the Consumer Key and Consumer Secret

Tip: External Client Apps support two active credential sets (main and staged), which allows zero-downtime credential rotation. For most use cases, you only need the main credentials.

Vault Connection Setup

In the Apideck Dashboard, go to Configuration > CRM > Salesforce.

The Salesforce connector also serves the Lead API, which has its own configuration page at Configuration > Lead > Salesforce. Both request the same OAuth scopes (api, openid, refresh_token), so a single External Client App covers both.

To connect your Salesforce account to Apideck, enter the Consumer Key & Secret from Salesforce: paste the Consumer Key into the Client ID field and the Consumer Secret into the Client Secret field. Confirm that your External Client App has api, openid and refresh_token selected under Selected OAuth Scopes. Once you have entered your credentials, click "Save settings".

To test the connection, click the "Test Vault" button. This will verify that the connection is working properly.

After completing these steps, you can allow your clients to authorize the connection to their Salesforce accounts securely.

Troubleshooting

Token refresh fails after connecting

If the initial authorization succeeds but token refresh fails, check that "Require Secret for Refresh Token Flow" is unchecked in your External Client App's Security settings. This is the most common misconfiguration — Apideck handles token refresh without sending the client secret, so this setting must be disabled.

To fix it: go to Setup > App Manager and open your External Client App (the same entry point used for the Consumer Key above), edit its OAuth Security settings under the app's Settings / Policies tabs, uncheck "Require Secret for Refresh Token Flow" and save.

Authorization fails immediately

If authorization fails with a missing required code challenge error, verify that "Require Proof Key for Code Exchange (PKCE)" is checked in your app's Security settings. Apideck sends PKCE parameters during authorization, and this setting must be enabled for them to be validated.

App not yet active

After creating your External Client App, it can take up to 10 minutes for the app to become active. If authorization fails immediately after setup, wait a few minutes and try again.

Still failing

If every setting above matches and authorization still fails, contact Apideck Support with the error message and the time of the attempt.

Existing Connected App customers

If you previously created a Connected App for your Salesforce integration, it will continue to work without any changes. Existing Connected Apps are not affected by the transition to External Client Apps.

Migrating a Connected App to an External Client App: If you choose to migrate, Salesforce's migration tool lives in Setup > App Manager > Migrate to External Client App. The original Connected App becomes read-only and new credentials are generated — the old Consumer Key and Consumer Secret will no longer work. You must update your credentials in Apideck after migration.

For more details on migration, see Salesforce's Connected App to External Client App Migration guide.