Prerequisites
Prerequisites Configuration
Configure Salesforce components for DuoKey BYOK integration
The Salesforce Shield integration is in preview and is not yet enabled on standard DuoKey Cockpit tenants. This guide describes how it works and how it is set up. Contact DuoKey to discuss access for your project.
Overview
The prerequisites include:
- Creating a Connected App in Salesforce
- Noting your Salesforce org ID and region
- Preparing a Named Credential to call DuoKey's Cache-Only Key Service
Step 1: Create Connected App
A Connected App establishes secure communication between DuoKey and Salesforce via REST API.
Navigate to App Manager
- Login to your Salesforce account
- Click the Setup gear icon
- In Quick Find, search for "App Manager"
- Navigate to Apps → App Manager
Create New Connected App
- Click New Connected App button
- Fill in basic information:
| Field | Value |
|---|---|
| Connected App Name | DuoKey BYOK Integration |
| API Name | (auto-populated) |
| Contact Email | [email protected] |
Configure OAuth Settings
- Check Enable OAuth Settings
- Set Callback URL:
sfdc://oauth/restapi/success - In Selected OAuth Scopes, add: Full access (full)
- Click Save
The callback URL sfdc://oauth/restapi/success is standard for Salesforce REST API integrations.
Get Consumer Key and Secret
- From App Manager, find your newly created Connected App
- Click the dropdown arrow (▼) and select View
- In API (Enable OAuth Settings) section, click Manage Consumer Details
- Enter the verification code sent to your email
- Copy and save securely:
- Consumer Key (Client ID)
- Consumer Secret (Client Secret)
Keep these credentials secure. You'll need them when configuring the DuoKey application.
Step 2: Prepare the Named Credential
DuoKey never logs into your Salesforce org and never needs your Salesforce username, password, or security token. Instead, Salesforce Shield calls DuoKey's Cache-Only Key Service (COKS) endpoint directly through a Named Credential, authenticated with a bearer connector secret that DuoKey generates for you during app creation.
Navigate to Named Credentials
- In Salesforce Setup, search for "Named Credentials" in Quick Find
- Navigate to Security → Named Credentials
Plan the Named Credential
You'll create the Named Credential (and its External Credential) after DuoKey generates the COKS endpoint URL and connector secret in the app creation wizard — note that you'll need to come back to this step once those values are available.
Salesforce Domain/Instance
- Navigate to Setup Home → Company Settings → My Domain
- Note your domain name (e.g.,
yourcompany.develop.lightning.force.com) - Extract the instance alias (e.g.,
yourcompany)
Credential Summary
| Credential | Description | Example |
|---|---|---|
| Consumer Key | From Connected App OAuth settings | 3MVG9... (long string) |
| Consumer Secret | From Connected App OAuth settings | 12345... (numeric string) |
| Domain/Instance | Your Salesforce domain alias | yourcompany |
| Connector Secret | Generated by DuoKey when you create the app (shown once) | <connector-secret> |
Consider using a secure password manager to store these credentials safely.