guides
Intended Documentation
Salesforce Connector Setup (Beta)
Connect Intended to Salesforce. Create a Connected App with the api and refresh_token scopes, obtain a refresh token, paste the instance URL, consumer key/secret, and refresh token, and run Test connection. OAuth refresh-token grant; host-pinned to *.salesforce.com. Beta until validated against your live org.
Salesforce Connector Setup (Beta)#
Connect Intended to Salesforce so approved intents can create and update Cases through the real Salesforce REST adapter (packages/execution-engine/src/adapters/salesforce.ts). Auth is an OAuth 2.0 refresh-token grant. Every write is Authority-Token-verified and ESCALATEs for approval under the starter policy.
This connector is Beta
The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live proof against your real Salesforce org is pending — treat Salesforce as Beta, not GA. See the Capability Truth Matrix.
What the adapter does#
| Property | Value |
|---|---|
| Actions | salesforce.case.create, salesforce.case.update |
| Auth | OAuth 2.0 refresh-token grant → Authorization: Bearer <token> |
| Host validation | Both the token-endpoint host and the resolved instance host must be salesforce.com or end with .salesforce.com, or it fails closed |
| Test connection | GET /services/data/ |
By default the token endpoint is https://login.salesforce.com (sandbox: https://test.salesforce.com via loginUrl). The instance_url returned by the grant is re-validated against *.salesforce.com; if absent or non-Salesforce it falls back to your configured instanceUrl.
Provider-side steps#
1. Create a Connected App#
- In Salesforce Setup → App Manager → New Connected App.
- Enable OAuth Settings and add the least-privilege OAuth scopes below.
- Set a callback URL (any valid HTTPS URL you control for the grant flow).
- Save, then copy the Consumer Key (
clientId) and Consumer Secret (clientSecret).
2. Obtain a refresh token (refreshToken, required)#
Run the OAuth web-server (authorization-code) flow once for the integration user to obtain a refresh token. Use a dedicated, least-privilege integration user so Case operations run under a constrained profile.
3. Instance URL (instanceUrl, required)#
Your org's instance URL, e.g. https://your-org.my.salesforce.com. It must be a *.salesforce.com host.
Least-privilege scope guidance#
- Matrix scopes for this connector:
api,refresh_token. api— REST access for Case create/update.refresh_token(a.k.a.offline_access) — issue the refresh token.- Constrain the integration user's profile / permission set to Create + Edit on the Case object only. Do not grant "Modify All Data" or admin.
Fields to paste into the connect dialog#
Open Connectors → Connect a system → Salesforce → Configure auth:
| Field label | Key | Required | Value |
|---|---|---|---|
| Instance URL | instanceUrl | Yes | https://your-org.my.salesforce.com |
| Consumer Key (Client ID) | clientId | Yes | Connected App consumer key |
| Consumer Secret (Client Secret) | clientSecret | Yes | Connected App consumer secret |
| Refresh Token | refreshToken | Yes | The OAuth refresh token |
Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.
Run Test connection#
- Finish the connect wizard to store the credential.
- On the connector card, click Test connection.
- The adapter performs the refresh-token grant and calls
GET /services/data/. A green result means the grant succeeded and both hosts passed validation.
Next steps#
- Connectors index — all 15 connector guides
- Enterprise-System Connectors (Beta) — shared reference
- Capability Truth Matrix — per-connector status