Package Installation Guide

Guide to install the Salesforce integration package and sync with Kernel

Kernel Salesforce integration installation and setup guide

The Kernel team will create an environment and logins for you. You can access this via app.kernel.ai.

Step 1: Your instance

You will need to select your CRM and then input your instance URL. This can be a production or sandbox environment. Then press continue.

This will provide you with the install link for the Kernel package in your CRM. Click to open the install.

Step 2: Package configuration

Prerequisites

• Salesforce System Administrator access in your target org

• Package version: Use the install link generated in Kernel. The link points to the current released package for your org.

Select installation options:

• Install for: Admins Only

• You will be prompted to grant the Kernel API access to the user & permission set you create. (This allows us to sync your CRM to Kernel and we only have access based on Permission Sets)

• Click Install

• Wait for "Install Complete" confirmation

Verify installation:

• Navigate to Setup → Installed Packages

• Confirm "Kernel SF Connected App" appears with status "Installed"

Open App Launcher (9-dot grid icon)

1. Select "Kernel Integration" app

2. Click the "Kernel Setup" tab

Step 3: Create integration user

The integration user is a dedicated System Administrator account that Kernel uses to access your Salesforce data securely.

Creating the user

1. In the Kernel Setup tab, locate the Integration User panel

2. Review default settings:

   • Email: [email protected]

   • First Name: Kernel

   • Last Name: Integration

   • Username Prefix: kernel-integration

3. Click "Create Integration User"

   • The system creates a unique username: kernel-integration@{OrgId}.kernel.ai

   • A password reset email is sent to the specified email address

   • The user is created with the System Administrator profile. This is for authorizing the app/user and can be changed to minimum access after a successful connection.

   
4. Verify user creation:

   • You'll see a success message with the user details

   

Permission set assignment

Object	Read	View-All	Edit
Account	✓ (All or select fields)	✓ (All or select fields)	✓ (Kernel fields)
Lead*	✓ (All or select fields)	✓ (All or select fields)	✓ (Kernel fields)
Contact	✓ (All or select fields)	✓ (All or select fields)
Opportunity	✓ (All or select fields)	✓ (All or select fields)
Task/Activity	✓ (All or select fields)	✓ (All or select fields)
SystemUser	✓ (Limited fields)

The system automatically assigns the Kernel_SF_Connected_App_PermissionSet to the integration user, which provides:

• API access

• Read access to standard and custom objects

• Access to Kernel-specific settings

You can also choose to assign your own custom permission set

Step 4: Authorize Kernel connection

Before authorizing the connection, you need your Kernel API credentials. These will now be shown in the Kernel App via the original page:

• Tenant ID: Your unique organization identifier (e.g., tenant_abc123xyz)

• API Key: Your secure API key for authentication

1. In the Kernel Setup tab, locate the Authorize Access panel

2. Enter your Kernel credentials:

   
3. Click "Sync with Kernel"

   

Finally, back in the Kernel app you will need to log in to the Salesforce instance to authorize the connection. On completion you will see our default fields to be mapped to your CRM. This means the installation is complete.

You can now proceed to set up the Kernel Custom Object.

Configuration options

Custom permission sets

By default, Kernel uses its standard permission set. For custom requirements:

1. In the Permission Sets panel:

   • Select "Choose Custom Permission Sets"

   • Select your organization's permission sets

   • Click "Save"

2. The selected permission sets will be assigned to the integration user

For full compatibility we recommend using the default Kernel permission set.

Non-admin sync access

Admins can enable Allow Non-Admin Sync to let users with Kernel_Readonly_PermissionSet run, configure, and schedule syncs through Kernel_Sync_User_PermissionSet, without granting the broader Kernel_Admin_PermissionSet. Sync schedules can run all active sync configs or only selected configs.

Because sync configuration requires Salesforce Metadata API permissions, only enable this for users who should be allowed to manage sync configuration.

Security and compliance

OAuth scopes

The Kernel Connected App requests these OAuth scopes:

• api - Access and manage your data

• refresh_token - Perform requests while you're offline

• openid - Access unique user identifier

• profile - Access basic profile information

• email - Access email address

Data access

• Access is logged and auditable

• All API calls are tracked in Setup Audit Trail

• Data transmission is encrypted via TLS 1.2+

Troubleshooting

Common issues and solutions

Issue	Solution
App not visible in App Launcher	Assign the Kernel Integration app to your user profile via Setup → App Manager
"Authorize" button disabled	Ensure Tenant ID and API Key are entered correctly
Permission Set assignment failed	Check if integration user is active; manually assign via Setup → Permission Sets

Managing the integration

Revoking access

To temporarily or permanently disconnect:

1. Revoke OAuth Token:

   • Setup → Connected Apps OAuth Usage

   • Find "Kernel SF Connected App"

   • Click "Revoke"

2. Deactivate Integration User:

   • Setup → Users

   • Find the kernel-integration user

   • Uncheck "Active"

   • Click Save

Re-establishing connection

1. Reactivate the integration user (if deactivated)

2. Return to Kernel Setup tab

3. Click "Authorize Kernel" again

4. Complete OAuth flow

Updating credentials

If your Kernel API credentials change:

1. Obtain new credentials from Kernel

2. In Salesforce Kernel Setup:

   • Click "Disconnect" (if connected)

   • Enter new Tenant ID and API Key

   • Click "Authorize Kernel"

   • Complete OAuth flow

Support

Getting help

• Email: [email protected]

• Include in your support request:

  • Organization ID

  • Environment type (Sandbox/Production)

  • Integration user username

  • Error messages or screenshots

  • Sync job IDs (from Kernel Portal)

Package components reference

What gets installed

Component	Purpose
Connected App	OAuth 2.0 authentication with Kernel
Lightning App	Kernel Integration application container
Custom Tab	Kernel Setup configuration interface
Apex Classes	Integration logic and API handlers
LWC Components	User interface for setup and management
Permission Set	Default access configuration
Custom Settings	Store integration configuration
Static Resources	Application icons and assets

Recent package changes

• v3.9.0

  • Adds Allow Non-Admin Sync for granting sync access via Kernel_Sync_User_PermissionSet

  • Adds per-config sync scheduler selection

• v3.8.0

  • Improves package install and test reliability by isolating package tests from subscriber Account DML

• v3.7.1

  • Adds the Standard sync direction toggle

  • Grants readonly users external credential access needed for enrichment callouts

• v3.7.0

  • Adds role-based permission sets and access gating

  • Adds the Account backfill setup step

• v3.6.0

  • Adds KERN ID on Account

  • Adds Kernel Search Accounts

  • Improves enrichment freshness and logging permissions

---