> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.trustmary.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Salesforce integration with trustmary (native)

# Salesforce Setup Guide
Trustmary connects to Salesforce through a small app that you create inside your own Salesforce org. This keeps your data under your own control — Trustmary never holds a master key to every customer's Salesforce, only the credentials you generate and hand over yourself.
The whole process takes about 15 minutes, plus a short wait while Salesforce applies your changes.
**You'll need:** a Salesforce user with admin rights (System Administrator profile or equivalent).
## Step 1 — Create a Connected App
1. Click the gear icon in the top right and choose **Setup**.
2. If you land in the older Salesforce Classic view, click your avatar in the top right and choose **Switch to Lightning Experience** first — the newer setup pages are easier to follow.
3. In the Setup search box, type **App Manager** and open it.
4. Click **New External Client App** in the top right.
5. Fill in the basic details:
    * **Connected App Name**: `Trustmary Integration`
    * **API Name**: fills in automatically
    * **Contact Email**: your own email address
## Step 2 — Turn on API access
1. Still on the same page, check **Enable OAuth Settings** in API (Enable OAuth Settings) section.
2. Under **Callback URL**, enter https://login.salesforce.com/services/oauth2/success. This URL is required by Salesforce but won't actually be used — Trustmary never redirects anyone through it.
3. Under **Selected OAuth Scopes**, add **Manage user data via APIs (api)** to the selected list.
4. Check **Enable Client Credentials Flow**. Salesforce will show a security warning — read it, then confirm.
5. Click **Create**.
> **Heads up:** Salesforce can take up to 10 minutes to apply a new connected app's settings. If the next steps don't work right away, wait a few minutes and try again.
## Step 3 — Choose which user the integration acts as
Client Credentials Flow needs a specific Salesforce user to act on behalf of — this decides what the integration can see and change, following that user's regular permissions.
1. In the "Trustmary Integration" app page (where you should be after copleting step 2), In P**olicies** tab, click **Edit**
2. Find the **OAuth Policies** section and locate **OAuth Flows and External Client App Enhancements.** Click **Enable Client Credentials Flow**. Add you username to **Run As** field.
3. Click **Save**.
> **Whatever this user can see and edit in Salesforce, the integration can see and edit too** — nothing more. If contacts or a custom field aren't showing up in Trustmary later, this is the first place to check.
## Step 4 — Get your Consumer Key and Consumer Secret
1. In External Client App Manager, where you should already be after completing step 3, change to **Settings** tab.
2. Expand the **OAuth Settings** tab.
3. Click **Consumer Key and Secret**
4. Salesforce emails a verification code to your account — enter it to continue.
5. Copy the **Consumer Key** and **Consumer Secret** shown on the page.
> **Treat the Consumer Secret like a password.** Copy it straight into Trustmary rather than into an email, chat message, or document. The page only stays unlocked for about 5 minutes before it asks you to verify again.
## Step 5 — Find your My Domain URL
1. In Setup, search for **My Domain**.
2. Copy the **Current My Domain URL** shown at the top of that page — it looks like https://yourcompany.my.salesforce.com.
> **Don't copy this from your browser's address bar.** While you're clicking around Setup, the address bar shows a different domain ending in `.`lightning.force.com — that's the Lightning app UI, not the API domain, and Trustmary can't connect through it. Always grab the URL from the My Domain page itself.
## Step 6 — Connect it in Trustmary
Back in Trustmary, open **Integrations → Salesforce** and enter the **Consumer Key**, **My Domain**, and **Consumer Secret** you copied above. Save, and Trustmary will use these to connect the next time it needs to talk to Salesforce.
## Troubleshooting
**"Client Credentials Flow" section isn't showing under Edit.** Make sure Step 2 was saved with "Enable Client Credentials Flow" checked — that section only appears after it's turned on.
**Trustmary can't connect right after setup.** Give it 10 minutes — new connected app settings take a while to roll out across Salesforce, per Step 2's note above.
**Trustmary connects, but some contacts or fields are missing.** Check that the user chosen in Step 3 actually has access to those records and fields in Salesforce. The integration is limited to exactly what that user can see.
**Salesforce rejects the connection with an "invalid\_client" type error.** Double-check the Consumer Key and Consumer Secret were copied without extra spaces or line breaks, and that they match the same connected app where Client Credentials Flow was enabled.
**Salesforce rejects the connection with an "unsupported\_grant\_type" error.** The My Domain value entered in Trustmary is almost certainly wrong — most often a `.`lightning.force.com URL copied from the browser address bar instead of the `.`my.salesforce.com URL from the My Domain Setup page (see the note in Step 5). Re-copy it from there, not from the address bar, and re-save.