# Salesforce

> Connect Salesforce to your agents for CRM data and Chatter.

**URL:** https://inference.sh/docs/credentials/salesforce
**Last updated:** 2026-09-24

---

Connect Salesforce to your agents for CRM data and Chatter.

---

## Overview

A Salesforce credential lets agents query and update CRM records, access Chatter feeds, and react to webhook triggers for leads, opportunities, and cases.

### Why "Bring Your Own Key" (BYOK)?

Salesforce connected apps live in your org. BYOK keeps OAuth credentials and API access under your control.

**Benefits:**

- **Your org** — production or sandbox, under your Salesforce admin policies
- **Scoped access** — request only the OAuth scopes your agents need
- **Your rate limits** — API usage counts against your org limits

---

## Prerequisites

Before connecting, you'll need:

1. A Salesforce account with permission to create connected apps
2. Access to **Setup → App Manager** in your Salesforce org

---

## Step 1: Create a connected app

1. In Salesforce, go to **Setup → App Manager**
2. Click **New Connected App**
3. Fill in basic information (name, contact email)
4. Enable **Enable OAuth Settings**
5. Set the callback URL:

| Environment | Callback URL |
|-------------|-------------|
| Production | `https://app.inference.sh/settings/secrets/oauth/salesforce` |
| Staging | `https://app.staging.inference.sh/settings/secrets/oauth/salesforce` |
| Local dev | `http://localhost:3000/settings/secrets/oauth/salesforce` |

6. Select OAuth scopes based on your needs (see [Capabilities](#capabilities))
7. Save and copy the **Consumer Key** (client ID) and **Consumer Secret**

---

## Step 2: Connect in inference shell

### Configure credentials

1. Go to **vaults → credentials**
2. Find **Salesforce** and click **Configure**
3. Enter:
   - **Client ID** (`SALESFORCE_CLIENT_ID`)
   - **Client Secret** (`SALESFORCE_CLIENT_SECRET`)
4. Optional: set **Is sandbox** (`SALESFORCE_IS_SANDBOX`) to `true` if connecting to a sandbox org (uses `test.salesforce.com` for login)
5. Click **Save credentials**

### Authorize the connection

1. Click **Connect**
2. Sign in to Salesforce and approve the requested permissions
3. Done — the credential status shows **Connected**

---

## Capabilities

| Capability | Description | Required Scopes |
|------------|-------------|-----------------|
| `salesforce.api` | Access Salesforce REST and SOAP APIs | `api` |
| `salesforce.chatter` | Access Chatter feeds and posts | `chatter_api` |
| `salesforce.full` | Full access (includes API and Chatter) | `full` |

---

## Triggers

| Trigger | Description | Required Scopes |
|---------|-------------|-----------------|
| `salesforce.lead.created` | New lead created | `api` |
| `salesforce.opportunity.stage_changed` | Opportunity stage changed | `api` |
| `salesforce.case.created` | New support case created | `api` |

---

## Using in apps

Declare Salesforce requirements in your app:

```yaml
# inf.yml
credentials:
  - key: salesforce.api
    description: Query and update CRM records

  - key: salesforce.chatter
    description: Post to Chatter feeds
    optional: true
```

At runtime, your app receives:

```bash
SALESFORCE_ACCESS_TOKEN=oauth2-access-token
SALESFORCE_INSTANCE_URL=https://your-org.my.salesforce.com
```

Use the instance URL and access token with the [Salesforce REST API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/).

---

## Next

→ [Credentials overview](/docs/credentials/overview)  
→ [Using credentials in apps](/docs/extend/credentials)