This is the easiest path. The connector wires the packaged Named Credential, External Credential, and External Auth Identity Provider for you.

In Salesforce, open the Akeneo PIM App home page. On the Connector Setup card, click Set Up under Configure Akeneo Credentials.

Enter your Akeneo base URL, Client ID, and Client Secret retrieved when creating the Custom App in Akeneo, then click Continue.

When Salesforce redirects you to Akeneo, authorize the connector. Complete this in the same browser session.

You need to grant all the requested permissions

After the Akeneo authorization returns to Salesforce, open Setup > Security > Named Credentials.

Click on the Named Credentials tab and select Akeneo. Make sure the Enabled for Callouts checkbox is checked. If it is off, switch Enabled for Callouts on, and save. Salesforce can turn callouts off after managed-package code updates the endpoint, so always check this before transfers.

Back on the Connector Setup card, click Grant Access so the user that runs transfers can use the packaged credentials.

When Set Up, Enabled for Callouts, and Grant Access are all complete, you are done - skip Part B: Manual fallback for Akeneo

Use this only if the in-app Set Up on the home page does not complete. You already have your Akeneo base URL, Client ID, and Client Secret (the same values you would enter on the home page). The packaged Akeneo Named Credential, External Credential, and External Auth Identity Provider already exist in your org. Replace their placeholder URLs, credentials, and custom request parameter values, then authenticate the existing Default principal. Do not create duplicate Salesforce credential records.

Named Credential URL Replacement

Go to Setup > Security > Named Credentials. Open the packaged Akeneo named credential, replace the placeholder URL with your Akeneo domain, confirm the External Credential is “Akeneo”, and make sure Enabled for Callouts is on. If it is off, edit the record, switch it on, and save before testing transfers.

Enter the External Auth Identity Provider data

On the External Auth Identity Providers tab, open the packaged Akeneo provider. Enter your Akeneo Client ID and Client Secret, and replace the placeholder Authorize URL and Token URL with your Akeneo domain:

https://<your-akeneo-domain>/connect/apps/v1/authorize
https://<your-akeneo-domain>/connect/apps/v1/oauth2/token

Generate the two Akeneo custom request parameter values in Salesforce Developer Console (Debug > Open Execute Anonymous Window). Use the same Akeneo Client Secret:

String clientSecret = 'your-akeneo-client-secret';

String codeIdentifier = EncodingUtil.convertToHex(Crypto.generateAesKey(128));
String codeChallenge = EncodingUtil.convertToHex(
    Crypto.generateDigest('SHA-256', Blob.valueOf(codeIdentifier + clientSecret))
);

System.debug('code_identifier: ' + codeIdentifier);
System.debug('code_challenge : ' + codeChallenge);

After executing it, open the execution log, click on Debug Only, and you should see two values as shown below. Take note of them.

In the Custom Request Parameters section, edit the existing code_identifier and code_challenge rows. Replace SET_DURING_AKENEO_SETUP with the generated values. Keep both rows as Token Request Body Parameter and do not create duplicate parameter rows.

Older versions of the app do not include the packaged External Credential or External Auth Identity Provider. On those versions, connect to Akeneo using the packaged Akeneo Auth. Provider (an Apex Auth. Provider plugin shipped with the app) together with a classic Named Credential. The plugin performs the Akeneo PKCE handshake for you, so you do not have to compute any code values by hand. The screenshots in this legacy section use placeholders only.

Create the Salesforce Auth. Provider

Go to Setup > Identity > Auth. Providers and click New. For Provider Type, choose Akeneo (the Apex plugin packaged with the app). Fill in the fields below and Save:

Create the Named Credential

Named Credentials are preconfigured endpoints together with safely stored authentication information.

That way, in Salesforce, we can simply use the callout name of a Named Credential to access an endpoint and its various targets without the need to deal with authentication.

Navigate to Setup > Security > Named Credentials

Do not simply click on the New button, but on the chevron next to it as shown in the image below, and then click on New Legacy.

Now enter the following information as shown below:

Once completed the input fields as shown above, click Save.

Now you should be redirected to Akeneo to complete the Connected App configuration you started before. So in the next screens agree on the Privacy Policy and Terms of Use, and configure the following screens for your needs. It will automatically proceed with the OAuth authorization and finally lead you into the logged-in Salesforce org.

If this happens, you have successfully configured the connection between both systems.

Once the app is authenticated, you will see this status in the Named Credential you have created. Ignore the warnings since the refresh access token stays permanent on the Akeneo side. 

User access

This classic Named Credential uses a Named Principal, so it stores one shared authentication that the connector's Apex uses (callout:Akeneo). No per-user principal assignment is required. If your org restricts Named Credential access, make sure the user that runs transfers can use it.