Overview
This guide configures Salesforce OAuth JWT authentication for Kolleno, enabling automated API access using:
Consumer Key (Client ID)
Salesforce Username
Private Key
No user interaction or password sharing is required.
Prerequisites
Admin Access: To create certificates and Connected Apps in Salesforce.
Integration User: A dedicated Salesforce user account for Kolleno (e.g.,
api@yourcompany.com).Profile Permissions
The integration user's profile must have the following:
• API Enabled
• At minimum, Read access to the Account object. This permission is necessary because Salesforce may validate object visibility during authentication or during initial requests.
Step 1: Generate a Certificate & Private Key
Choose one method below:
Method A: Generate in Salesforce (Recommended)
Go to Setup → Certificate and Key Management → Create Self-Signed Certificate.
Name it (e.g.,
Kolleno_JWT_Cert).Save → Salesforce generates a certificate and private key.
Export the Private Key:
In Certificate and Key Management, click your certificate → Export to Keystore → Download the
.jksfile.Use KeyStore Explorer (GUI) or
keytool(CLI) to extract the private key as key file, must be in pem format.
Method B: Generate via OpenSSL
Generate private key (PEM format)
openssl genpkey -algorithm RSA -out kolleno.key -pkeyopt rsa_keygen_bits:2048
Generate self-signed certificate
openssl req -new -x509 -key kolleno.key -out kolleno.crt -days 365`
Use
kolleno.keyas your private key.Upload
kolleno.crtto Salesforce in Step 2.
Step 2: Create an External Client App
Go to Setup → External Client App Manager → New External Client App
Configure settings:
External Client App Name:
Kolleno IntegrationContact Email: Your email
Distribution State: Local
Callback URL:
http://localhost(doesn’t matter for this integration, but the url is still required by Salesforce)
Under API (Enable OAuth Settings):
✅ Enable OAuth Settings
Callback URL: http://localhost
Enable JWT Bearer Flow:
Perform requests at any time (refresh_token, offline_access)Manage user data via APIs (api)
✅ Use Digital Signatures → Upload your certificate (
.crtfile).Create
Copy Consumer Key and Secret under Settings → OAuth Settings
Step 3: Assign Permissions
In your External Client App Manager → Manage → Edit Policies:
Permitted Users: Set to Admin approved users are pre-authorized.
Assign the app to the integration user’s Profile or Permission Set:
a. Go to Select Profiles → Add the integration user’s profile → Save
Step 4: Gather Credentials for Kolleno
Credential | How to Obtain |
Consumer Key | From the Manage External Client App details (Step 2). |
Username | Salesforce login email of the integration user (e.g., |
Private Key | Exported from Salesforce ( |