Before you start
- A Salesforce account with access to the records you want to sync.
- Owner or admin access to the organization in the app.
Step-by-step
- 1
Connect
Integrations → Salesforce → Connect, then "Continue with Salesforce" and approve access. Your instance URL is returned by Salesforce automatically and validated as a public https host.
- 2
Token fallback (only if needed)
If you maintain your own connected app, you can still provide an instance URL + credentials under manual setup.
Security best practices
- Use the Web Server (authorization-code) flow with refresh tokens, not a static password.
- The instance URL is checked to block private/internal addresses (SSRF protection).
- Credentials are encrypted at rest with AES-256-GCM — they are never stored in plain text.
- Only organization owners and admins can create or modify a connection.
- Prefer OAuth where available: it issues short-lived, scoped, revocable tokens instead of long-lived secrets.
- When you must use a token, create a fine-grained, least-privilege token and rotate it periodically.