Salesforce Native App Credentials in OneTrust
OneTrust provides multiple credential options for connecting to Salesforce. Depending on the option you choose, you can either enter the Salesforce connection details in OneTrust or use a guided authorization flow.
Strengthening Security Together
Salesforce is strengthening security requirements for partner integrations, including requirements for credential management, OAuth governance, and security review. OneTrust is adopting the Salesforce Native App model to support these requirements and provide a more secure connection experience.
The change primarily affects how the Salesforce credential is created, authorized, and used in OneTrust. It does not by itself describe changes to the data handled by a specific OneTrust integration. Workflow-specific permissions, mappings, and configuration requirements continue to depend on the OneTrust product and Salesforce use case.
Security Considerations
The Salesforce Native App and supported OAuth flows are designed to protect the connection. OneTrust protects credentials, authentication tokens, and connection information through its security controls. This article does not describe the underlying storage, encryption, architecture, or access-control implementation; refer to the applicable OneTrust security white paper for those details.
Salesforce Credential Options in OneTrust
Credential Options
When you add Salesforce as a system in OneTrust, the credential selector may present several authentication options. The table summarizes the primary options and how they differ.
Use Simple Connect when it is available for your Salesforce connection and you want OneTrust to supply the predefined authentication values. Use Configure manually when you need to enter and manage the connection parameters yourself. Treat OAuth password and refresh token credentials as separate existing options and follow the instructions provided for your OneTrust release.
Simple Connect is the recommended option for ECA-based Salesforce connections. Follow your release guidance for existing password-grant and refresh-grant connections.
Existing Salesforce credential types may continue to work. Confirm the applicable OneTrust release guidance before changing an existing credential.
| Credential Option | Authorization Experience | Information You Provide | Usage Guidance |
|---|---|---|---|
| Simple Connect | Streamlined OneTrust External Client App (ECA) connection flow. Provide the Salesforce host name, select Login, and sign in to Salesforce when prompted. OneTrust supplies the remaining authentication values. OneTrust protects the credentials and authentication tokens used for the connection. | Salesforce host name. | Recommended for ECA-based Salesforce connections when available. |
| Configure Manually | Full credential form for entering and managing the connection parameters yourself. If available for your configuration, PKCE adds an additional safeguard to the authorization process. | For an OAuth 2.0 authorization-code configuration, the form may include the Salesforce authorization URL, token URL, client ID, client secret, scope, and a callback URL populated by OneTrust. | Use when you need to enter and manage the Salesforce connection parameters yourself. Follow your OneTrust release guidance for PKCE availability. |
| OAuth Password Credentials | Existing Salesforce authentication option. | Required information depends on your OneTrust release and Salesforce configuration. | Follow the setup instructions for your OneTrust release. |
| Refresh Token Credentials | Existing Salesforce authentication option. | Required information depends on your OneTrust release and Salesforce configuration. | Follow the setup instructions for your OneTrust release. |
OneTrust Administrators
OneTrust administrators may need to:
- Create or update the Salesforce credential in the appropriate OneTrust configuration area.
- Enter the Salesforce connection values requested by the credential configuration.
- Complete authorization and test the credential.
- Associate the credential with the required workflows.
- Confirm that each workflow has the permissions it needs to complete its configured actions.
- Document the credential owner, Salesforce tenant, assigned workflows, and approval history.
Salesforce Administrators
Salesforce administrators may need to:
- Install or approve the OneTrust Salesforce Native App as part of the credential authorization process.
- Review the requested permissions and confirm that they meet internal security requirements.
- Authorize access for the Salesforce user or users who will establish the connection.
- Provide the Salesforce details required by the OneTrust credential configuration.
- Coordinate testing with the OneTrust administrator responsible for the affected workflows.
Security and Privacy Teams
Security and privacy teams should review the requested access before authorization. Use the least-privilege principle: grant only the permissions required for the approved Salesforce use case and OneTrust workflows.
Create a Salesforce Credential in OneTrust
When you create a Salesforce credential in OneTrust, choose the credential option that matches your Salesforce connection and the amount of connection information you want to manage in OneTrust. The primary options are Simple Connect and Configure manually. Existing OAuth password and refresh token credentials are described separately under Salesforce credential options in OneTrust.
Make sure you have:
- Access to the OneTrust credential or integration configuration.
- The Salesforce tenant information and connection values requested by OneTrust.
- Salesforce administrator access sufficient to install or approve the Native App.
- Approval from the appropriate security or privacy team.
- A test plan for the Salesforce workflows that will use the credential.
- For Simple Connect, provide the Salesforce host name.
Figure 1. Simple Connect form before entering the host name
- Select Login to start the authorization flow.
Figure 2. Simple Connect form with the host name entered
- Sign in to Salesforce and authorize OneTrust when prompted.
Figure 3. Salesforce login page
Figure 4. Sign in to Salesforce
- Return to OneTrust after authorization is complete.
Figure 5. Return to OneTrust after authorization
- If the PKCE option is available for your configuration, enable it.
PKCE adds an additional safeguard to the authorization process. Follow your release-specific guidance for availability.
Figure 6. Configure manually form with PKCE enabled
Salesforce Native App Credential Troubleshooting
Salesforce Native App Cannot Be Installed or Approved
The Salesforce Native App cannot be installed or approved during the credential authorization process.
The Salesforce account does not have the required permissions, or marketplace app installation is restricted.
The account used for installation or authorization may not have the permissions required to install or authorize applications.
- Confirm that you are using a Salesforce account with the permissions required to install or authorize applications.
- Contact your Salesforce administrator if your organization restricts marketplace app installation.
Salesforce Authorization Fails
Authorization fails when OneTrust starts the Salesforce authorization flow.
The wrong Salesforce tenant or permissions are being used, or the authorization URLs do not match the environment.
The signed-in Salesforce tenant may be incorrect, the requested permissions may not have been approved, or the authorization and token URL values may not match the Salesforce environment.
- Confirm that you are signed in to the correct Salesforce tenant.
- Confirm that the requested permissions were approved.
- If OneTrust requests authorization and token URL values, verify that they match your Salesforce environment.
Salesforce Credential Test Fails in OneTrust
The Salesforce credential test fails in OneTrust after the credential is configured.
The connection values, permissions, or user access are incorrect or insufficient.
The Salesforce tenant information, credentials, authorization values, app permissions, or permissions of the user associated with the connection may not support the workflow actions.
- Verify the Salesforce tenant information, credentials, authorization values, and app permissions.
- Confirm that the user associated with the connection can perform the actions required by the workflow.
Workflow Cannot Use the New Salesforce Credential
A workflow cannot use the new Salesforce credential after the credential is created.
The credential was not saved or assigned to every Salesforce action, or the workflow lacks required permissions.
The credential may not have been saved successfully, may not be assigned to every Salesforce action in the workflow, or may not have the permissions required by the workflow.
Salesforce Native App Credential FAQ
Why Is OneTrust Changing the Salesforce Authentication Method?
Salesforce is strengthening security requirements for partner integrations. The Native App method supports stronger credential management and modern OAuth security practices.
What Does PKCE Protect?
PKCE is an additional security safeguard used by supported authorization flows. OneTrust handles it as part of the authorization process.
Do I Need to Update an Existing Salesforce Integration?
Not necessarily. Existing Connected App integrations may continue to work, but new integrations should use the approved Native App or External Client App path. Follow OneTrust migration guidance for your release and environment.
Are My Salesforce Workflows or Data Mappings Changing?
The Native App changes the authentication method. Workflow behavior, permissions, and mappings depend on the specific OneTrust integration and Salesforce use case. Validate each affected workflow after setup.
What Information Is Used to Create the Credential?
Enter the Salesforce connection details requested by the OneTrust credential configuration, such as your Salesforce credentials, authorization URL, token URL, and other required values. The required information depends on the Salesforce use case and the OneTrust workflows you configure.
What Permissions Are Required?
Required permissions depend on the Salesforce use case and the OneTrust workflows you configure. Review the permissions shown during app installation and grant only the access required for the approved functionality.
Can I Create a New Salesforce Connected App?
Salesforce Connector guidance states that new Connected Apps are no longer available for new integrations beginning with Spring ’26. Use the current OneTrust Native App or External Client App instructions instead.