> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abundly.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce

> Manage contacts, accounts, opportunities, leads, and more

Connect your agent to Salesforce to read and update any data in your CRM — contacts, accounts, opportunities, leads, cases, tasks, custom objects, and more. The agent can call any Salesforce REST API endpoint, including SOQL queries, so anything you can do in Salesforce, the agent can do too.

## How to enable

Go to **Settings → Capabilities** and enable **Salesforce**, then link a workspace secret containing your Salesforce login URL, Consumer Key, and Consumer Secret. The same secret can be reused across agents and teams.

## Example use cases

* **Lead triage** — "Every morning, list new leads from the last 24 hours and email me a summary grouped by lead source"
* **Opportunity monitoring** — "Check for opportunities closing this month that haven't had activity in 14 days, and create a follow-up task on each"
* **Account research** — "Look up this account and summarize open opportunities, recent cases, and the primary contact"
* **Data hygiene** — "Find duplicate contacts (same email) and report them to me"
* **Custom objects** — "Read this week's records from our custom Project\_\_c object and post a summary to the #sales Slack channel"

## How to set up Salesforce authentication

Salesforce uses **External Client Apps** (the modern replacement for Connected Apps) with the OAuth 2.0 Client Credentials Flow for server-to-server access. The agent authenticates as a Salesforce user you choose ("run-as user"), so everything the agent does is performed and audited as that user.

<Steps>
  <Step title="Find your My Domain login URL">
    In Salesforce **Setup**, search for **My Domain**. The **Current My Domain URL** at the top is what you'll use as the **Login URL** in Abundly.

    <Warning>
      Salesforce gives each org three different URL aliases. Only the canonical **`https://<your-org>.my.salesforce.com`** version works for OAuth. The other two — `…my.salesforce-setup.com` (Setup pages) and `…lightning.force.com` (Lightning UI) — will not authenticate. Take the URL straight from the My Domain page in Setup to be safe.
    </Warning>
  </Step>

  <Step title="Create an External Client App">
    In **Setup**, search for **External Client App Manager** and click **New External Client App**.

    In **Basic Information**:

    * **External Client App Name**: e.g. "Abundly Agent"
    * **API Name**: auto-fills
    * **Contact Email**: your email
    * Leave **Distribution State** as **Local**
  </Step>

  <Step title="Enable OAuth and add scopes">
    Check **Enable OAuth**, then in **App Settings**:

    * **Callback URL**: Enter `https://login.salesforce.com/services/oauth2/success` (a placeholder — Client Credentials Flow doesn't use it, but the form requires a value).
    * **Selected OAuth Scopes**: Move at least **Manage user data via APIs (api)** to the right. For broader access during evaluation, also add **Full access (full)**. You can tighten this later.
  </Step>

  <Step title="Enable Client Credentials Flow">
    Scroll down to **Flow Enablement** and check **Enable Client Credentials Flow**.

    Then in **Security**:

    * Leave **Require secret for Web Server Flow** and **Require secret for Refresh Token Flow** checked (the defaults).
    * **Uncheck** **Require Proof Key for Code Exchange (PKCE) extension**. PKCE doesn't apply to Client Credentials Flow and breaks token issuance if left enabled.

    Click **Create** to save the app.
  </Step>

  <Step title="Set the Run As user">
    On the new app's detail page, open the **Policies** tab and click **Edit**. Scroll to **OAuth Flows and External Client App Enhancements**.

    In the **Run As (Username)** field, enter the Salesforce **username** of the user the agent should act as (the exact username is shown under **Setup → Users**, and isn't always the same as the email).

    <Warning>
      The agent will see and modify data exactly as the run-as user can. We recommend a dedicated integration user with the **Minimum Access – API Only Integrations** profile and only the permission sets the agent needs.
    </Warning>

    Save the policy.
  </Step>

  <Step title="Wait for activation">
    External Client Apps take **about 10 minutes** after creation before they can issue tokens. If you try to authenticate immediately and get an `invalid_client_id` error, wait and retry.
  </Step>

  <Step title="Copy the Consumer Key and Secret">
    On the app's detail page, open the **Settings** tab and click **Consumer Key and Secret**. Salesforce will send a verification code to your email — enter it. Copy the **Consumer Key** and **Consumer Secret**.
  </Step>

  <Step title="Configure in Abundly">
    Go to **Settings → Capabilities**, enable **Salesforce**, and create a new workspace secret of type **Salesforce**. Paste:

    * **Login URL** — your `https://<your-org>.my.salesforce.com` from step 1. For sandboxes, use the sandbox's My Domain URL or `https://test.salesforce.com`.
    * **Consumer Key**
    * **Consumer Secret**

    All three values live in a single workspace secret, so you only have to enter them once and can share the same secret across multiple agents.
  </Step>
</Steps>

<Note>
  If your org is older and still allows Connected Apps, that path also works (Connected Apps remain functional even though new ones can no longer be created in fresh orgs). The OAuth flow is identical — only the Setup screens differ.

  See [Salesforce's Client Credentials Flow documentation](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm) for more details.
</Note>

## API version

The agent calls the Salesforce REST API at `https://{your-instance}/services/data/v66.0/...`. If you need a different API version, just tell the agent — it can target any version your org supports.

## Downloading files

The agent can download files (PDFs, attachments) from Salesforce using `salesforce_api_request` with `saveResponseAsDocument: true`. The response is saved as an agent document for transcription or PDF reading.

For PDFs and attachments, prefer the Connect API endpoint:

`GET /services/data/v66.0/connect/files/{ContentDocumentId}/content`

Some endpoints (such as ContentVersion `VersionData`) return valid file bytes but omit `Content-Type`. If needed, the agent can set `responseDocumentName` (e.g. `contract.pdf`) or `responseDocumentMimeType` (`application/pdf`) when saving.