Articles on: Integrations
This article is also available in:

Salesforce integration with Trustmary

Trustmary connects to Salesforce through a small app created inside the customer's own Salesforce org. The data stays under the org's own control — Trustmary never holds a master key to every customer's Salesforce, only the credentials generated and handed over from that org.


The whole setup takes about 15 minutes, plus a short wait while Salesforce applies the changes.


Requires: a Salesforce user with admin rights (System Administrator profile or equivalent).


Quick steps


  1. In Salesforce Setup, open App Manager and click New External Client App.
  2. Check Enable OAuth Settings, add the Manage user data via APIs (api) scope, check Enable Client Credentials Flow and click Create.
  3. On the app's Policies tab, click Edit, enable Client Credentials Flow and set the Run As user.
  4. On the Settings tab, open OAuth Settings → Consumer Key and Secret and copy both values.
  5. In Setup, open My Domain and copy the Current My Domain URL.
  6. In Trustmary, open Integrations → Salesforce and enter the Consumer Key, the My Domain URL and the Consumer Secret.


Step 1 — Create an External Client App


  1. Click the gear icon in the top right and choose Setup.
  2. If Salesforce opens in the older Classic view, click the avatar in the top right and choose Switch to Lightning Experience first — the newer setup pages are easier to follow.
  3. In the Setup search box, type App Manager and open it.
  4. Click New External Client App in the top right.
  5. Fill in the basic details:
    • External Client App Name: Trustmary Integration
    • API Name: fills in automatically
    • Contact Email: the admin's own email address


Step 2 — Turn on API access


  1. Still on the same page, check Enable OAuth Settings in the API (Enable OAuth Settings) section.
  2. Under Callback URL, enter https://login.salesforce.com/services/oauth2/success. Salesforce requires the URL, but it is never used — Trustmary never redirects anyone through it.
  3. Under Selected OAuth Scopes, add Manage user data via APIs (api) to the selected list.
  4. Check Enable Client Credentials Flow. Salesforce shows a security warning — read it, then confirm.
  5. Click Create.


Salesforce can take up to 10 minutes to apply a new app's settings. If the next steps don't work right away, wait and try again.


Step 3 — Choose which user the integration acts as


The Client Credentials Flow needs a specific Salesforce user to act on behalf of. That user's regular permissions decide what the integration can see and change.


  1. On the Trustmary Integration app page, open the Policies tab and click Edit.
  2. In the OAuth Policies section, find OAuth Flows and External Client App Enhancements and check Enable Client Credentials Flow.
  3. In the Run As field, enter the username of the user the integration should act as. A user's own username is shown under the avatar menu → Settings → Personal Information.
  4. Click Save.


Whatever this user can see and edit in Salesforce, the integration can see and edit too — nothing more. If contacts or a custom field aren't showing up in Trustmary later, this is the first place to check.


Step 4 — Get the Consumer Key and Consumer Secret


  1. Still in the app's settings, open the Settings tab.
  2. Expand the OAuth Settings section.
  3. Click Consumer Key and Secret.
  4. Salesforce emails a verification code to the account — enter it to continue.
  5. Copy the Consumer Key and the Consumer Secret shown on the page.


Treat the Consumer Secret like a password. Copy it straight into Trustmary rather than into an email, a chat message or a document. The page stays unlocked for about 5 minutes before it asks for verification again.


Step 5 — Find the My Domain URL


  1. In Setup, search for My Domain.
  2. Copy the Current My Domain URL shown at the top of that page. It looks like https://yourcompany.my.salesforce.com.


Don't copy this from the browser's address bar. In Setup, the address bar shows a different domain ending in .lightning.force.com — that is the Lightning app UI, not the API domain, and Trustmary can't connect through it. Always take the URL from the My Domain page itself.


Step 6 — Connect it in Trustmary


Back in Trustmary, open Integrations and select Salesforce. Enter the Consumer Key and the My Domain URL, then click Keys and secrets and paste the Consumer Secret. Save, and Trustmary uses these credentials the next time it talks to Salesforce.


Wrapping up


The connection is ready to use as soon as it is saved, but a newly created app can take up to 10 minutes to be accepted by Salesforce. Once connected, the integration can send surveys to Salesforce contacts and write responses back — see Salesforce Sync-back settings for what each sync-back switch does.


Troubleshooting


The Client Credentials Flow section isn't showing under Edit. Make sure Step 2 was saved with Enable Client Credentials Flow checked — the section only appears after it is turned on.


Trustmary can't connect right after setup. Give it 10 minutes. New app settings take a while to roll out across Salesforce.


Trustmary connects, but some contacts or fields are missing. Check that the user chosen in Step 3 has access to those records and fields in Salesforce. The integration is limited to exactly what that user can see.


Salesforce rejects the connection with an invalid_client error. Check that the Consumer Key and Consumer Secret were copied without extra spaces or line breaks, and that they come from the same app where the Client Credentials Flow was enabled.


Salesforce rejects the connection with an unsupported_grant_type error. The My Domain value entered in Trustmary is almost certainly wrong — most often a .lightning.force.com URL copied from the address bar instead of the .my.salesforce.com URL from the My Domain page. Copy it again from there and save.

Updated on: 05/11/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!