> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce

> Connect your AI agent to a user's Salesforce account to create or update leads, manage contacts, and automate case management.

Connect your AI agent to a user's Salesforce account to create or update leads and contacts, log call and email activities, generate reports, and automate case management.

## Connect Salesforce to Auth0

**1. Salesforce setup**

1. Sign up for a [Salesforce Developer account](https://developer.salesforce.com/signup) or use your existing Salesforce org.
2. In your Salesforce org, navigate to **Setup** → **Platform Tools** →  **Apps** → **App Manager**.
3. Select **New External Client App**.
4. Fill in the basic information:
   * **Connected App Name**: Enter a descriptive name for your integration
   * **API Name**: This will be auto-generated based on the app name
   * **Contact Email**: Your email address
5. In the **API (Enable OAuth Settings)** section:

   * Select **Enable OAuth Settings**
   * **Callback URL**: `https://YOUR_AUTH0_DOMAIN/login/callback`

   You can find the **Auth0 domain** in the [Auth0 Dashboard](https://manage.auth0.com/).

   You can find this under **Applications > \[Your Application] > Settings > Basic Information > Domain**.

   If you are using the [custom domains](https://auth0.com/docs/customize/custom-domains.md) feature, your Auth0 domain is the custom domain. You can find this under **Branding > Custom Domains**.

   * **Selected OAuth Scopes**: Add the following scopes:
     * `api` - Access and manage your data (api)
     * `refresh_token` - Perform requests on your behalf at any time (refresh\_token, offline\_access)
     * `openid` - Access your identity URL service
6. **Important Token Configuration** (for optimal Token Vault compatibility):
   * **Require Secret for Web Server Flow**: Select this option for enhanced security
   * **Require Secret for Refresh Token Flow**: Select this option to secure token refresh operations
   * **Enable Refresh Token Rotation**: Select this option to enable rotation on each refresh
   * **Issue JSON Web Token (JWT)-based access tokens for named users**: Select this option for longer token validity and better performance
7. Select **Create** and wait for the app to be created.
8. After creation, note your **Consumer Key** (Client ID) and **Consumer Secret** (Client Secret).

**Token configuration notes:**

* If you select **opaque** tokens instead of JWT, Token Vault will default the expiry time to 10 minutes, which may cause frequent token refreshes.
* Ensure the `refresh_token` scope is enabled in your Connected App settings, not just requested in Auth0. Without this scope enabled on the Salesforce side, Auth0 cannot request refresh tokens.
* Consider enabling refresh token rotation for better security practices.

To learn more about Salesforce Connected App setup, read the [Create a Connected App documentation](https://help.salesforce.com/s/articleView?id=sf.connected_app_create.htm).

**2. Auth0 setup**

<ol>
  <li>In the [Auth0 Dashboard](https://manage.auth0.com), go to
  **Authentication > Social**.</li>
  <li>Select **Create Connection**, then choose **Salesforce**.</li>
  <li>Select **Continue**.</li>

  <li>
    In **General**:

    <ol type="A">
      <li>Enter the **Client ID** and **Client Secret** from
      your Salesforce OAuth app.</li>

      <li>
        Under **Scopes**, select the scope(s) required for your
        application. These determine what permissions your application can
        request from Salesforce, whether for authentication (such as
        accessing basic profile details) or for API access (such as
        connecting to the provider's APIs).

        For a Dropbox and Google social
        connection, you must select **Offline Access** in the Auth0 Dashboard, enabling
        the client application to obtain an Auth0 refresh token.
      </li>

      <li>Add any additional scopes your application requires in the
      **Additional Scopes** field.</li>
    </ol>
  </li>

  <li>In **Purpose**, toggle on **Connected Accounts for Token Vault**. This lets the
  connection retrieve and securely store access tokens for external
  APIs. Learn more in
  [Connected Accounts for Token Vault](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/connected-accounts-for-token-vault.md).</li>
  <li>Select **Create**.</li>

  <li>
    After creation, you are redirected to the **Applications** page.
    Select the application(s) to enable this connection for.

    In a new Auth0 tenant, you can select the **Default App**.
  </li>

  <li>Once you have created your Salesforce social connection, [test your connection](https://auth0.com/docs/authenticate/identity-providers/test-connections.md) to ensure the setup is working correctly before using it in your application.</li>
</ol>

**Required scopes:** Make sure to include the following scopes in your Auth0 connection configuration:

* `openid` - Access your identity URL service
* `api` - Access and manage your data
* `refresh_token` - Perform requests on your behalf at any time
* `offline_access` - Maintain access when you're not present

These scopes must also be enabled in your Salesforce Connected App configuration.

This guide walks you through setting up the **Salesforce** connection in Auth0.
For an end-to-end example that shows how to set up your app to call third-party APIs on the user's behalf
using a connection like this, read the
[Call third-party APIs on user's behalf quickstart](https://auth0.com/ai/docs/get-started/call-third-party-apis-on-users-behalf.md).

## Token Vault configuration example

To configure the Token Vault for your Salesforce connection, you can use the following code snippet in your application:

**JavaScript**

**Python**

## Troubleshooting

### Invalid grant errors

If you encounter `invalid_grant` errors with expired access/refresh tokens:

1. **Check token configuration**: Ensure your Connected App uses JWT tokens instead of opaque tokens.
2. **Verify refresh token policy**: Set the refresh token policy to "valid until revoked" in your Connected App.
3. **Scope configuration**: Confirm that the `refresh_token` and `offline_access` scopes are enabled in both your Salesforce Connected App and Auth0 connection.
4. **Token rotation**: If using refresh token rotation, ensure your application handles the new refresh token returned with each refresh request.

### Common Issues

* **Scope errors**: Ensure all required scopes are enabled in your Salesforce Connected App settings, not just requested in Auth0.
* **Token expiry**: JWT tokens have longer expiry times than opaque tokens. If using opaque tokens, expect frequent token refreshes.
* **Multiple authorizations**: Avoid authorizing the same user multiple times rapidly, as this may cause token invalidation issues.

For additional troubleshooting resources, refer to Salesforce's OAuth troubleshooting documentation and error code references.

## Next steps

* To learn how to configure applications to access Token Vault, read [Configure Token Vault](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/configure-token-vault.md).
* If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations.md), authenticate the user with the target organization before initiating the Connected Accounts flow. Connected accounts remain linked to the individual user profile.
* To learn how to get an access token to make a tool call, complete the [Call third-party APIs on user's behalf Quickstart](https://auth0.com/ai/docs/get-started/call-third-party-apis-on-users-behalf.md).