Salesforce OAuth 2.0 connector profile – StackOne setup guide

Sign in to your Salesforce account and click the Setup ⚙️ icon in the top-right menu.

In the left navigation under Platform Tools, expand Apps and click App Manager.

• Click the New External Client App button in the top-right corner

In the Basic Information section, enter the following details.

• External Client App Name: StackOne Integration (or your preferred name)
• API Name: Will auto-populate based on the app name
• Contact Email: Your admin email address

Check the Enable OAuth Settings checkbox to expand the OAuth configuration section.

• In Callback URL, enter: https://api.stackone.com/connect/oauth2/salesforce/callback

Under Selected OAuth Scopes, add the following scopes.

• Manage user data via APIs (api)
• Perform requests at any time (refresh_token, offline_access)
• In Security, keep Require secret for Web Server Flow and Require secret for Refresh Token Flow checked (default)
• In Security, uncheck Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows (otherwise Salesforce returns missing required code challenge)

Click Create at the bottom of the page.

• You will be redirected to the Connected App detail page
• Note: It may take up to 10-20 minutes for the app to become active

In the left navigation under Platform Tools, expand Apps then External Client Apps and click External Client App Manager or OAuth Usage.

• Open the app you created (e.g., StackOne Integration)
• Go to Settings > OAuth Settings
• Click Consumer Key and Secret
• You may be prompted to verify your identity via email or authenticator

Copy the Consumer Key (Client ID) and Consumer Secret (Client Secret).

• Store these credentials securely for use later
• The Consumer Key is your Client ID
• The Consumer Secret is your Client Secret

Select the environment that matches your Salesforce org.

• Production: Select this for your live Salesforce org with real data
• Sandbox: Select this for testing environments or developer orgs
• Sandbox environments are typically used for development and testing before deploying to production

When providing custom scopes, you must include at least one of refresh_token or offline_access to ensure the connection can refresh its access token.

• If the OAuth Scopes field is left blank, the default scopes (api refresh_token offline_access) are used automatically
• If you specify custom scopes, always include refresh_token or offline_access (e.g., api chatter_api content refresh_token offline_access)
• Without a refresh scope, the connection will fail because Salesforce will not issue a refresh token
• Every custom scope you specify must also be added to the Connected App’s Selected OAuth Scopes, otherwise Salesforce returns an OAuth Error