Connecting Salesforce to Stacktic

For: a Salesforce admin. Takes about 15–20 minutes.

What this integration does

Connecting Salesforce lets Stacktic see everyone with a user account in your organization. When someone leaves, Stacktic can deactivate them.

Salesforce has no way to delete a user at all, even by hand in Salesforce's own UI. So deactivating is the whole of "removing" someone. It ends their sign-in and frees their license. Their record, their ownership of Salesforce data, and their history all stay exactly as they were.

To connect, you set up a server-to-server login, which Salesforce calls the OAuth 2.0 client credentials flow. Every request runs as one integration user you name. It doesn't run as whoever set the connection up, or as anyone's personal login. The credential belongs to your organization, not to that admin, so it keeps working if they leave.

Stacktic needs three values:

Value	What it is
Instance URL	The My Domain address you sign in to this Salesforce organization at.
Consumer key	From the external client app (or connected app) you create for this connection.
Consumer secret	From the same app. Stacktic stores it encrypted and only ever shows you its last 4 characters.

Before you start

You need to be able to create an external client app and assign permissions in Salesforce Setup. Salesforce is in the middle of renaming this feature, so you may also see it called a connected app.
You need this organization's My Domain URL: the address you sign in at.
Pick which Salesforce user this connection will run as. It's worth creating a dedicated integration user, because this credential is meant to belong to your organization, not to a person. But any user works, as long as it has the right permissions (Step 1).
You might run more than one Salesforce organization, such as a sandbox next to production. If so, you'll repeat this whole process once for each one. A connection works with exactly one organization.

Step 1: Set up the integration user's permissions

Salesforce's client credentials flow runs every request as one user, set on the app itself. Give that user:

"API Enabled": required. Without it, nothing this connection does will work, not even the connection check in Step 4.
"View All Users": needed for Stacktic to see your full member list. Without it, Salesforce's own User Sharing settings can quietly limit what this integration user (and so Stacktic) can see. See What Stacktic's member list might be missing below.
"Manage Users": only needed if you want Stacktic to deactivate people automatically. Skip it for now if you just want visibility. You can add it later without reconnecting.

Step 2: Create an external client app for the client credentials flow

Salesforce's own Connected App client credentials setup guide walks through the exact Setup screens. Use it for the click-by-click path. Salesforce's own console layout is the authority on that, not this article. Two things matter for Stacktic:

Set up the app's OAuth settings for the client credentials flow.
Set its run-as user to the integration user from Step 1.

Step 3: Get the instance URL, consumer key, and consumer secret

Still in Setup → App Manager, open the external client app you just created → OAuth settings:

Consumer Key: shown right on this page.
Consumer Secret: click "Click to reveal" next to it.
Instance URL: the My Domain address you sign in to this organization at, over https. Stacktic ignores everything after the host, so you can paste any Salesforce URL from this organization.

Step 4: Connect in Stacktic

In Stacktic, go to Tools → Salesforce → Integration and enter:

Instance URL
Consumer key
Consumer secret

Click Connect. Stacktic uses the credential to get a short-lived access pass. Then it runs a small query to check two things: that the credential leads to a real organization, and that the integration user can actually read the User object. If the check fails, Stacktic tells you which piece is wrong: a bad instance URL, a rejected credential, or a missing permission.

Step 5: Turn on removal (when you're ready)

Stacktic starts reading your user list as soon as you connect. Deactivating someone during an offboarding is a separate switch. Because deactivation is destructive, it's off by default, even if the integration user already has "Manage Users." When you're ready, turn on Automated user removal on the integration. (If the integration user doesn't have "Manage Users" yet, grant it first. See Step 1.)

What you'll see

Salesforce doesn't give the organization's display name to an app using client credentials. So the connected card is labeled with the instance host instead (for example, your-company.my.salesforce.com). That's the address an admin recognizes anyway.

Role: each person's Salesforce profile (for example, "System Administrator" or "Standard User") shows as their role, exactly as your organization labels it. Organizations often customize profile names, so Stacktic doesn't try to standardize them.
External users: someone with a partner or customer portal license type is flagged as external, not as an employee.
Guest users: Guest-site users don't appear on the list. They're placeholders for public sites that don't need a sign-in, not people who sign in.
Deactivated users: a deactivated Salesforce user stays on the list instead of disappearing. Salesforce never deletes a User record. So Stacktic keeps showing them, with their access marked as removed, instead of losing them from the list.

What Stacktic's member list might be missing

This is worth reading even if nothing's wrong yet. Stacktic's list is every user that your integration user's own User Sharing settings let it see. That isn't always every licensed user in the organization.

Here's when it falls short. If Users are set to a Private organization-wide default, and the integration user doesn't have "View All Users," Salesforce answers with a shorter list. It does this quietly, with no error. Stacktic can't tell the difference between "this organization really only has these users" and "our integration user can't see the rest."

In practice: if someone doesn't show up in Stacktic, that alone doesn't prove they have no Salesforce access. Grant the integration user "View All Users" if you want to be sure Stacktic sees everyone.

What removal does (and doesn't do)

Salesforce has no delete API for a user, anywhere. Stacktic isn't choosing to avoid it. It's a permanent limit of the platform, including Salesforce's own UI. So "removal" here always means deactivation. Deactivation:

Ends their sign-in and frees their license.
Does not delete their user record, their ownership of any Salesforce data, or their history. All of that stays exactly as it was.
Does not change their access to any other Salesforce organization. A sandbox and production are entirely separate connections, with entirely separate users.

Salesforce can also refuse a deactivation outright. The most common reasons: the person is still the default owner of leads, or is named on an approval process. When that happens, Stacktic shows Salesforce's own reason, so you know what to reassign first. Then you can retry the offboarding step.

Security notes

Least privilege. "API Enabled" is required for any access at all. "View All Users" only matters if your organization sets Users to Private. "Manage Users" is needed only for automatic removal. Leave it off and stay read-only until you're ready.
Belongs to the service, not a person. The client credentials login runs as the integration user set on the app. It isn't tied to whichever admin set the connection up. Someone leaving your team won't break it.
No documented expiry. The consumer secret doesn't expire on its own. If someone replaces or revokes it in Salesforce, Stacktic's next request for an access pass fails. Then Stacktic flags the connection as needing to reconnect. You get no advance warning, because Salesforce doesn't share one.
Stored encrypted. Stacktic keeps the instance URL, consumer key, and consumer secret, all encrypted. It never shows the full secret again.
You can cut it off anytime. In Salesforce Setup, turn off the client credentials flow, delete the app, or remove the integration user's permissions. The connection stops working right away.

Troubleshooting

Message in Stacktic	Likely cause and fix
"Salesforce instance URL … isn't a usable https address — check your org's My Domain URL."	The Instance URL field isn't a full `https://` address. Paste your organization's My Domain URL.
"Salesforce rejected the credential (HTTP 400/401). Check the instance URL, consumer key and consumer secret."	One of the three values is wrong. Or the consumer secret was replaced or revoked. Or the instance URL points at a different organization than the one the app belongs to. Copy fresh values from Setup → App Manager and reconnect.
"Salesforce refused to list users — confirm the integration user has 'API Enabled' and 'View All Users'."	The credential works, but the integration user is missing a required permission. Grant it, then reconnect.
Connection flips to "needs reauth" sometime after connecting	The consumer secret was replaced or revoked in Salesforce, or the integration user lost "API Enabled." Get a fresh secret (or restore the permission) and reconnect.
Offboarding removal reports the person couldn't be found, or is already deactivated	Already handled. You don't need to do anything.
Offboarding removal fails with a permission-denied message	The integration user doesn't have the access needed to deactivate this specific person, because of a restriction on that one record. The rest of the connection is fine. Check the integration user's permissions for that record, then retry.
Offboarding removal fails naming a default lead owner, an approval-process assignee, or similar	Salesforce itself is blocking the deactivation, because this person is named somewhere else. Reassign that in Salesforce, then retry.
Someone with a known Salesforce license doesn't show up in Stacktic's list	See What Stacktic's member list might be missing. The likely cause is a Private organization-wide default plus a missing "View All Users."

Frequently asked questions

Does this delete a Salesforce user when they're offboarded? No. Salesforce has no way to delete a user at all, even by hand in its own UI. Deactivation ends their sign-in and frees their license. Their record, data ownership, and history all stay exactly as they were.

Do I need to grant "View All Users" and "Manage Users"? "API Enabled" is required no matter what. "View All Users" matters only if your organization sets Users to Private. Without it, Stacktic's list may be missing people. "Manage Users" is needed only if you want Stacktic to deactivate people automatically during an offboarding.

I run a sandbox and a production organization. Do I connect both? Yes. A connection covers exactly one Salesforce organization. Repeat this setup once for each one, each with its own external client app and its own instance URL.

Will connecting change or delete anything right away? No. Connecting only runs a read-only check to confirm the credential and permissions work. Stacktic deactivates people only during an offboarding, and only after you turn on Automated user removal.

What happens to a person's owned records when they're deactivated? Nothing. Deactivation only ends sign-in and frees the license. Ownership of leads, opportunities, and everything else stays exactly as it was.