> ## Documentation Index
> Fetch the complete documentation index at: https://docs.voltai.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce

> Create an External Client App (or Connected App) in your Salesforce org so Voltai can query records.

**You'll create:** an **External Client App** (modern, preferred) or a **Connected App** (legacy, still works) inside your Salesforce org.

**We'll be able to read:** records available through the API to the connecting user, bounded by their profile and sharing rules.

<Warning>
  **Edition check first.** Salesforce **Starter Edition** does not include API access, so no OAuth integration can work at all. You need **Enterprise**, **Unlimited**, **Developer**, or a Sandbox.
</Warning>

## Steps

<Steps>
  <Step title="Open External Client App Manager">
    Sign in to the Salesforce org you want to connect.

    Click the gear icon (top right) → **Setup**. In the Quick Find box, search for **External Client App Manager** and open it.

    If your org does not have it, use **App Manager → New Connected App** instead — the fields are nearly identical.
  </Step>

  <Step title="Create the app and enable OAuth">
    Click **New External Client App** and fill in:

    * **External Client App Name**: `Voltai`
    * **API Name**: `Voltai`
    * **Contact Email**: your admin email
    * **Distribution State**: **Local**

    Tick **Enable OAuth**, then complete the OAuth section:

    * **Callback URL**: the [redirect URI](/connectors/introduction#redirect-uri-used-by-every-connector)
    * **Selected OAuth Scopes**:
      * `Manage user data via APIs (api)`
      * `Perform requests at any time (refresh_token, offline_access)`
      * `Access the identity URL service (id, profile, email, address, phone)`
    * **Require Secret for Web Server Flow**: **enabled**
    * **Require Proof Key for Code Exchange (PKCE)**: **disabled**

    <Warning>
      Leave PKCE unchecked. We do not currently send a code verifier, so enabling it will break the connection.
    </Warning>

    Click **Create**.
  </Step>

  <Step title="Set the policies">
    Open the app you just created, go to the **Policies** tab, click **Edit**, and set:

    * **Permitted Users**: **All users may self-authorize**
    * **IP Relaxation**: **Relax IP restrictions**
    * **Refresh Token Policy**: **Refresh token is valid until revoked**

    Save.
  </Step>

  <Step title="Wait about 10 minutes">
    Salesforce caches new app metadata. Until propagation finishes, authorization fails with `invalid_client_id` even though everything is configured correctly.
  </Step>

  <Step title="Copy the Consumer Key and Secret">
    Back in the app's overview, open **Settings → OAuth Settings → Consumer Key and Secret** and reveal both values.
  </Step>
</Steps>

## Send us

| Value           | Where to find it                                                             |
| --------------- | ---------------------------------------------------------------------------- |
| `client_id`     | **Consumer Key**                                                             |
| `client_secret` | **Consumer Secret**                                                          |
| `login_url`     | Your org's My Domain login URL, for example `https://acme.my.salesforce.com` |

For sandbox users, `login_url` should be `https://test.salesforce.com`. If you omit it we default to `https://login.salesforce.com`, which is only reliable when every end-user's Salesforce session lives in the same org where you created the app.

## Things to know

* One production org with one My Domain? The `login.salesforce.com` default is fine.
* Users spread across **multiple Salesforce orgs** under the same Trailblazer ID? Always set `login_url` to the specific org's My Domain, or Salesforce routes the OAuth request to the wrong org and returns `invalid_client_id`.
* Connected Apps behave identically for our purposes: **Setup → App Manager → New Connected App**.