Create a custom OAuth profile for Salesforce ​

Sign in to Workato.

Go to Tools > Custom OAuth profiles.

Click + New custom profile.

Select Salesforce from the Application drop-down menu.

Select Salesforce

Enter a name for your custom OAuth profile in the Name field.

Name your custom OAuth profile

Click Create new app.

Open a new tab and sign in to your Salesforce account.

Go to Setup > Apps > External Client Apps > External Client App Manager.

Click New External Client App.

Enter a name for your external client app in the External Client App Name field.

In the API Name field, enter a name that meets the following requirements:

• Contains only underscores and alphanumeric characters.
• Is unique.
• Starts with a letter.
• Doesn't include spaces.
• Doesn't end with an underscore.
• Doesn't contain consecutive underscores.

Enter the contact email address for your app in the Contact Email field.

Use the Distribution State drop-down menu to select either Local or Packaged.

Expand the API (Enable OAuth Settings) section and select the Enable OAuth checkbox.

Enter the following URL in the Callback URL field:

https://www.workato.com/oauth/callback

Select the OAuth scopes for the external client app in the OAuth Scopes field. Then, click the Move selection to Selected OAuth Scopes arrow to apply the scopes.

Configure scopes for your external client app

Configure the following settings:

• In the Flow Enablement section, select only the Enable Authorization Code and Credentials Flow checkbox.
• In the Security section, configure the following:
  • Select the Require secret for Web Server Flow and Require secret for Refresh Token Flow checkboxes. These settings are required for the connection to work.
  • Leave the Issue JSON Web Token (JWT)-based access tokens for named users checkbox unselected.
  • The following settings are generally optional, but may be required depending on your AppExchange partnership status with Salesforce:
    • Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows
    • Enable Refresh Token Rotation
    • Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days. Test this setting in a non-production environment before enabling it broadly. This setting may cause connection instability in some configurations. If you experience issues after enabling it, disable it and contact Workato Support.
    • Enforce Refresh Token IP Allowlist. If you enable this setting, refer to Workato's IP addresses for the values to add.

Configure the Flow Enablement and Security fields

Click Create to create the external client app.

Click the Settings tab for your external client app.

Expand the OAuth Settings section.

Click Consumer Key and Secret.

Click Consumer Key and Secret

Enter your credentials and provide the one-time password (OTP) if prompted.

Copy the Consumer Key and Consumer Secret. These values are required to configure Workato to communicate with your app.

Retrieve the consumer key and consumer secret

Return to the Workato tab.

Paste the consumer key from Salesforce into the Client ID field.

Paste the consumer secret from Salesforce into the Client secret field.

Fill in the client ID and client secret fields

Click Save, then click Done.