Skip to main content
Requires Salesforce admin access to create an External Client App, and an Account Engagement edition that includes API access.

​
Sign in to Salesforce

Sign in to the Salesforce org that owns your Account Engagement business unit.

The Salesforce Log In with Email page with the Continue button highlighted

​
Create an External Client App

Register the Salesforce External Client App that StackOne uses to authenticate with Account Engagement.

1

Open the new External Client App form

In Salesforce Setup, navigate to Platform Tools > Apps > App Manager.

  • Click New App in the top-right corner, then choose New External Client App.
The App Manager page with New External Client App highlighted in the New App menu
2

Fill in basic information

Complete the Basic Information section.

  • External Client App Name: StackOne Pardot Integration
  • API Name: fills in automatically from the External Client App Name
  • Contact Email: an address your team monitors
  • Leave Distribution State set to Local.
The Basic Information section with the app name, API name and contact email fields highlighted
3

Enable OAuth and set the callback URL

Expand API (Enable OAuth Settings) and select the Enable OAuth checkbox to reveal the App Settings fields.

  • Callback URL: copy it from your Connector Profile
The API section with the Enable OAuth checkbox and Callback URL field highlighted
4

Select OAuth scopes

Enables actions: Add Prospect To List, Add Tag To Campaign, Add Tag To Dynamic Content, Add Tag To File, Add Tag To Landing Page, Add Tag To Prospect, Add Tag To User, Connect Salesforce Campaign, Create Custom Field, Create Custom Redirect, Create Dynamic Content, Create Email Template, Create Engagement Studio Program, Create Form, Create Landing Page, Create Layout Template, Create List, Create Prospect, Create Tag, Delete Custom Field, Delete Custom Redirect, Delete Email Template, Delete File, Delete Form, Delete Layout Template, Delete List, Delete Prospect, Delete Tag, Download Engagement Program Structure, Get Account, Get Campaign, Get Custom Field, Get Custom Redirect, Get Dynamic Content, Get Email Template, Get Engagement Program, Get File, Get Folder, Get Folder Contents Record, Get Form, Get Landing Page, Get Layout Template, Get List, Get List Email, Get List Email Stats, Get List Membership, Get One-to-One Email, Get Opportunity, Get Prospect, Get Tag, Get Tagged Object, Get Tracker Domain, Get User, Get Visitor Activity, List Campaigns, List Custom Fields, List Custom Redirects, List Dynamic Content, List Email Templates, List Engagement Programs, List Files, List Folder Contents, List Folders, List Forms, List Landing Pages, List Layout Templates, List List Emails, List List Memberships, List Lists, List One-to-One Emails, List Opportunities, List Prospects, List Tagged Objects, List Tags, List Tracker Domains, List Users, List Visitor Activities, Merge Tags, Remove Prospect From List, Remove Tag From Campaign, Remove Tag From Dynamic Content, Remove Tag From File, Remove Tag From Landing Page, Remove Tag From Prospect, Remove Tag From User, Send List Email, Send One-to-One Email, Undelete Prospect, Update Custom Field, Update Custom Redirect, Update Email Template, Update File, Update Layout Template, Update List, Update List Membership, Update Prospect, Update Tag, Upload File, Upsert Prospect By Email

In OAuth Scopes, select each scope in Available OAuth Scopes and click the right-arrow button to move it to Selected OAuth Scopes.

5

Review the enforced security settings

Salesforce applies several settings in the Security section that an admin cannot change. Each is marked “To change this required setting, contact Support.”

  • Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows is selected. StackOne sends PKCE, so no action is needed.
  • Enable Refresh Token Rotation is selected. Salesforce issues a new refresh token on every refresh.
  • Limit Idle Refresh Token Time-To-Live (TTL) to 30 Days is selected. A connection that sits idle longer than 30 days must be reauthorized.
The Security section showing the enforced PKCE, refresh token rotation and idle TTL settings
6

Create the External Client App

Click Create. The OAuth settings can take 2-10 minutes to propagate before the app accepts authorization requests.

​
Set the Refresh Token Policy

The refresh token policy controls how long a connected account stays authorized. Salesforce enforces an idle expiration on External Client Apps, so the policy cannot be set to never expire.

1

Open the policy editor

Open the app from Platform Tools > Apps > External Client Apps > External Client App Manager, then go to the Policies tab and click Edit.

2

Choose a refresh token policy

In the App Authorization section, choose an option under Refresh Token Policy (Idle Expiration Time Limit Enforced).

  • Expire refresh token if not used for specific time is the default. Set Refresh Token Validity Period and Refresh Token Validity Unit to the longest idle window your use case allows. StackOne refreshes the token on a regular schedule, so an active connection stays within the limit.
  • Expire refresh token after specific time ends the session at a fixed age regardless of use. The end user must reauthorize once it elapses.
  • Immediately expire refresh token ends the connection after a single use and is not suitable for StackOne.
  • Click Save.
The App Authorization section with the Refresh Token Policy options highlighted

​
Retrieve the Client ID and Client Secret

The Consumer Key and Consumer Secret are the values StackOne needs to authenticate.

1

Open Consumer Key and Secret

Open the app from External Client App Manager, go to the Settings tab, expand OAuth Settings, and click Consumer Key and Secret.

  • Salesforce may email you a verification code before it shows the values. Enter the code and click Verify.
The OAuth Settings section with the Consumer Key and Secret button highlighted
2

Copy the values into StackOne

The Consumer Details page shows both values, each with its own Copy control.

  • Copy the Consumer Key into the Client ID (Consumer Key) field in the StackOne Connector profile.
  • Copy the Consumer Secret into the Client Secret (Consumer Secret) field in the StackOne Connector profile.
  • Leave OAuth Scopes blank in the StackOne Connector profile to use the defaults, or enter the same space-separated scopes you selected on the app.
  • Note: You can retrieve both values again from this screen later, but Salesforce asks you to verify your identity each time.
  • Store both values securely for use later.
The Consumer Details page showing the Consumer Key and Consumer Secret rows with their values masked

​
Creating the StackOne Connector Profile

To create the Connector Profile in StackOne for Pardot:
1

Open the connector

Log in to StackOne, open Connectors, and select Pardot.
2

Choose actions and events

  • Click Add Profile.
  • If the connector offers more than one authentication method, set the Auth Method filter to OAuth 2.0.
  • Select the actions, and any events, to enable for this Connector Profile.
  • Click Continue.
3

Set up authentication

  • Select Authentication Type as OAuth 2.0.
  • Fill out the fields using details retrieved from your provider:
    • Client ID (Consumer Key)
    • Client Secret (Consumer Secret)
    • OAuth Scopes (Optional)
  • Click Create Profile.
Congratulations! The new Connector Profile now shows up on the connector page. If you created it as a project member rather than an admin, it starts disabled until a project admin enables it. You can now continue to Link Accounts for Pardot.