Okta Salesforce Provisioning Integration Error Could Not Verify Administrator Credentials

An error occurs when enabling Salesforce provisioning in Okta if the API credentials, instance type, or Security Assertion Markup Language (SAML) identity type are incorrect, or if the connected app has the Proof Key for Code Exchange (PKCE) extension enabled. Resolve this by verifying the credentials, selecting the correct instance type, disabling the PKCE extension, and updating the SAML identity type for sandbox environments.

When attempting to enable provisioning for Salesforce within Okta, entering the OAuth Consumer Key and OAuth Consumer Secret, and testing the API credentials, Okta generates the following error:

Could not verify the Salesforce administrator credentials; please confirm that these are set correctly.


 

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Provisioning
• Okta Integration Network (OIN)
• Salesforce

This error occurs due to one of the following reasons:

• The OAuth Consumer Key and OAuth Consumer Secret contain incorrect values.
• The Instance Type does not reflect the correct value (Production, Sandbox, Government).
• The SAML identity type in Salesforce does not reflect the correct value.
• The OAuth configuration of the connected app in Salesforce has the Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows option enabled.

How is the Salesforce administrator credentials error resolved?

Verify the credentials, select the correct instance type, disable the PKCE extension, and update the SAML identity type for sandbox environments by following these steps.

1. Verify that the OAuth Consumer Key and OAuth Consumer Secret contain the correct values.
2. Select the correct Instance Type that matches the one used for Salesforce when creating the integration in Okta.
3. Disable the Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows option. For more details, review the Configure OAuth and REST integration documentation.
4. Navigate to the SAML Identity Type and change it from Assertion contains the Federation ID from the User object to Assertion contains the User's Salesforce username if configuring a Sandbox environment in Salesforce.
5. Re-authenticate the API credentials after completing the previous steps.