SendSafely

Articles in this section

See more

Updating the AWS Dropzone Connector for Salesforce's New External Client App Requirement

Follow

Salesforce has restricted the creation of new Connected Apps as of the Spring '26 release. New integrations must now be registered as an External Client App instead. Existing Connected Apps continue to work, but our migration path is a clean-slate deployment: you stand up a brand-new connector stack alongside the existing one, validate it end-to-end against a test Dropzone, and only cut production over once everything is confirmed working. Nothing in production is touched until the final step.

Note: All existing functionality stays the same after migrating. The External Client App issues the same Consumer Key, Consumer Secret, and Refresh Token that a Connected App did — no behavior changes for your agents or customers.

Step 1: Create a new test Dropzone (owned by a Service Account)

For this migration we stand up a new test Dropzone owned by a dedicated Service Account, created by an Administrator from the Enterprise Console. A Service Account is the recommended Dropzone Owner — it can't log into the portal, needs no email inbox, and isn't tied to any one employee, so the Dropzone survives staff turnover. This keeps all validation traffic off your production Dropzone until you're ready to cut over.

1a. Create the Service Account

  1. Log in as an Enterprise Administrator and open the Enterprise Console (from the Account menu).
  2. Go to the Add Users section.
  3. Enter a username in email format — no real inbox is required (e.g., salesforce-test@yourcompany.com).
  4. From the Login Type dropdown, select Service Account (No Login).
  5. Click Add User.

The account is added immediately and appears in the Registered Users list with a padlock icon, indicating it isn't permitted to log in.

1b. Enable the Dropzone on the Service Account

Admins configure a Service Account by impersonating it from the Enterprise Console:

  1. In Registered Users, click View on the Service Account's row and select Profile from the dropdown. A yellow banner confirms you're now acting as that account.
  2. Navigate to the Dropzone Profile (from the Dropzone menu option or the account Profile page).
  3. The Dropzone is OFF by default — set the switch to ON to enable it and reveal the Hosted Dropzone URL.
  4. Set the Form Input Label to something intuitive for Salesforce, such as Case Number.
  5. Optionally set the file expiration window and add any recipients (registered users) who need to access uploaded files.

Note down, for later:

  • The Dropzone ID
  • The Dropzone's validation key

Step 2: Create a new External Client App in Salesforce

A Dropzone Connector application must be configured in Salesforce as an External Client App so the connector can update existing cases or open new cases with secure links.

2a. Create the External Client App

  1. In Salesforce, go to Setup and type Apps in the Quick Find box. In the left-hand menu, select External Client Apps → External Client App Manager.
  2. Click New External Client App and configure the following.

Basic Information (all required):

  • External Client App Name — a descriptive name such as SendSafely Dropzone Connector
  • API Name — auto-populated from the name above (customize if needed)
  • Contact Email — the application administrator's email

API (Enable OAuth Settings):

  • Check Enable OAuth Settings.
  • Set the Callback URL:
    • Production: https://login.salesforce.com/services/oauth2/success
    • Sandbox: https://test.salesforce.com/services/oauth2/success

  • Add the following OAuth Scopes:

    • Full access (full)
    • Manage user data via APIs (api)
    • Perform requests at any time (refresh_token, offline_access)

     

  • Check Require Secret for Web Server Flow (if not already checked).
  • Both Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows and Require Secret for Refresh Token Flow are enabled by default — leave them as it is.
  1. Click Create.

Under the Settings tab → OAuth Settings, you'll find the Consumer Key and Consumer Secret. You'll need both in Step 3 and Step 5.

2b. Configure Policies

  1. Open the app's policies from the summary page shown at the end of Step 2a, or from External Client App Manager → (your app) → Edit Policies.
  2. Under the Policies tab, click Edit.

OAuth Policies:

  • Set Permitted Users to Admin approved users are pre-authorized (click OK when prompted).
  • “Expire refresh token if not used for specific time” button for the Refresh Token Policy.
  • Set the Refresh Token validity period to 30 days.
  • Optionally configure an application specific Timeout Value under Session Policies. This will determine how long the OAuth access token issued to the application remains active for, before a token refresh is required. 

Profiles:

  • Under App Policies, add the profile of the user account that will authorize the connector, then click Save.

Step 3: Generate a new Refresh Token

Run the getRefreshToken.js script (Obtain Salesforce Refresh Token) using the Consumer Key and Consumer Secret from Step 2.

  • The script prints a URL — open it in a browser while authenticated to Salesforce and approve the authorization request.
  • You'll land on a Remote Access Application Authorization screen. Copy the code=XXXX value from the URL (excluding the code= prefix) and paste it back into the script when prompted.
  • The script prints the Refresh Token.

Treat the Refresh Token as a Salesforce credential — do not store it unprotected or share it.

Step 4: Deploy a fresh Dropzone Connector stack

This is a clean deployment — do not update the existing stack.

  1. Contact support@sendsafely.com to obtain the latest CloudFormation template file. You might have already received this as part of the outreach campaign. In case of doubts please fell free to reach out to us.
  2. Log in to AWS and switch to the us-east-1 region (the template queries resources from that region). 
    1. If you are in a different region you can download the function zip file, upload it to a S3 bucket of your choice and update the Cloudformation Template to refer to that s3 object.
  3. Go to CloudFormation → Create stack → With new resources (standard).
  4. Under Template source, select Upload a template file and choose the latest YAML.
  5. On Specify stack details, enter a stack name and an Email Address for Error Notifications.
  6. Complete the prompts to create the stack.

After the stack is created, AWS sends an SNS subscription confirmation to the error-notification address. Confirm it — if you don't, you risk data loss during a connector failure.

If you need more guidance on this please follow the guide here: 

Step 5: Populate the connector secrets

Open the SecretsManager link on the stack's Resources tab and set:

  • sendsafely_validation_key — the test Dropzone's validation key from Step 1
  • salesforce_consumer_key — from Step 2
  • salesforce_consumer_secret — from Step 2
  • salesforce_refresh_token — from Step 3

Optionally review:

  • salesforce_is_sandbox

Then open the Lambda function → Configuration → Environment variables and set connector behavior:

  • NEW_CASE_ON_INVALID_SUBMISSION — true or false
  • NEW_CASE_IF_CASE_CLOSED — true, false
  • REQUIRE_CASE_NUMBER_AND_RECORD_ID — true or false

Step 6: Validate against the test Dropzone

  1. Copy the new connector's webhook URL (from the API Gateway created by the stack).
  2. In the SendSafely portal, open the test Dropzone → Notification Settings → select Use a Webhook for notifications and paste in the webhook URL.
  3. Make a test submission to the test Dropzone using a valid Case Number (or CaseNumber-CaseId, if applicable).
  4. Confirm the secure link is posted to the corresponding Salesforce Case.

Do not proceed until the test submission works end-to-end.

Step 7: Cut production over

Once the new stack is validated, flip production onto it:

  1. Get the production Dropzone's validation key from the SendSafely portal.
  2. In the new connector's Secrets Manager, replace sendsafely_validation_key (currently the test Dropzone's key) with the production Dropzone's validation key.
  3. Copy the new connector's webhook URL (from API Gateway) and, in the production Dropzone's Notification Settings, replace the existing webhook URL with the new one.
  4. Verify a production submission posts its secure link to the Case as expected.

Keep the old connector stack in place until you've confirmed production traffic is flowing through the new one, then decommission it (and the test Dropzone) at your convenience.

Rollback: Reverting to the Old Stack

If you need to rollback to use the original connector stack, the process is simple—you just set the Webhook URL of the production SendSafely Dropzone to the API Gateway URL of the original stack. The old stack still holds the production Dropzone's validation key and its (still-valid) Connected App credentials, so nothing on the AWS side needs to change.

  1. In the SendSafely portal, open the production Dropzone → Notification Settings.
  2. Under Use a Webhook for notifications, replace the new connector's webhook URL with the old connector's webhook URL (from the old stack's API Gateway).
  3. Confirm the old connector's sendsafely_validation_key still matches the production Dropzone's current validation key. If editing the webhook regenerated the Dropzone's validation key, update sendsafely_validation_key in the old stack's Secrets Manager with the current value.
  4. Make a production submission and confirm the secure link is posted to the Case via the old connector.

Comments

0 comments

Please sign in to leave a comment.