Create Salesforce App
Create Salesforce BYOK Application
Complete wizard for configuring DuoKey Salesforce BYOK integration
The Salesforce Shield integration is in preview and is not yet enabled on standard DuoKey Cockpit tenants. This guide describes how it works and how it is set up. Contact DuoKey to discuss access for your project.
Prerequisites
- Getting Started guide completed
- Prerequisites Configuration completed
- Salesforce org ID and region noted
- An AES-256 encryption key available in your DuoKey vault
Application Creation Wizard
Enter BYOK Application Details
| Field | Required | Description |
|---|---|---|
| BYOK app name | Yes | Descriptive name (e.g., Production Salesforce BYOK) |
| Salesforce Domain Alias | Yes | Your subdomain only (e.g., mycompany from mycompany.develop.lightning.force.com) |
Copy the domain alias exactly as it appears in your Salesforce My Domain settings. Do not include .develop.lightning.force.com.
Click NEXT STEP to continue
Configure the Named Credential
| Field | Required | Description |
|---|---|---|
| OAuth2 Client ID | Yes | From your Salesforce Connected App / External Credential |
| OAuth2 Client Secret | Yes | From your Salesforce Connected App / External Credential |
| Token URL | Yes | The OAuth2 token endpoint Salesforce uses to authenticate to DuoKey |
DuoKey never asks for your Salesforce username, password, or security token — Salesforce Shield calls DuoKey's Cache-Only Key Service endpoint directly using this Named Credential.
Click NEXT STEP to continue
Assign Access Control
Configure role-based access control:
- Select one or more DuoKey roles for this application
- Only users with these roles can view and manage the integration
- Roles are defined in your DuoKey organization's RBAC settings
Access control ensures only authorized team members can manage your Salesforce encryption keys.
Click NEXT STEP to continue
Select BYOK Encryption Key
Choose the encryption key from your DuoKey vault:
- Select from available keys in your DuoKey vault
- The key must be a compatible symmetric encryption key
- Create a new key before starting if needed
Use a dedicated key specifically for Salesforce BYOK. Document which key is used for which environment.
Click NEXT STEP to continue
Configure the COKS Endpoint
Set the Cache-Only Key Service endpoint configuration:
- Allowed operations (wrap / unwrap)
- The generated endpoint identifier you'll reference from Salesforce
Click NEXT STEP to continue
Review and Deploy
- Review configuration summary
- Verify all information is correct
- Click SUBMIT to complete setup
DuoKey will:
- Deploy the COKS wrap/unwrap endpoint bound to your selected key
- Generate a one-time connector secret — copy it now, as it is not shown again
The encryption key itself never leaves your DuoKey vault. Salesforce Shield calls DuoKey's wrap/unwrap endpoint on demand using the Named Credential and connector secret — nothing is transferred to your Salesforce organization.
Creation Success
Your Salesforce BYOK application is now configured. Finish by entering the endpoint URL and connector secret into the Named Credential you created in Salesforce (Step 3).
Post-Creation Steps
Verify in Salesforce
- Login to your Salesforce organization
- Navigate to Setup → Security → Named Credentials
- Verify the Named Credential you configured in Step 3 shows a successful test connection
View in DuoKey Apps
- Return to the DuoKey Apps page
- Your new Salesforce BYOK application will be listed
- You can view, edit, or manage the application from here
Configure Shield Platform Encryption
In Salesforce, configure which fields and files should use your BYOK encryption key. Refer to Salesforce Shield Platform Encryption documentation.