> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/salesforce.md). # Salesforce Connect your company's Salesforce org to Cakewalk's MCP Gateway. Every agent tool call against Salesforce passes through the gateway and is evaluated against your Policies. ## Setup Flow: Register your own app Salesforce does not register with Cakewalk automatically. An Admin creates an External Client App in Salesforce, points its callback at Cakewalk, and pastes the Client ID and Secret into Cakewalk. Salesforce also requires you to activate the MCP server and grant users access to it. Both happen once, on the Salesforce side. ## Requirements * A Salesforce System Administrator, to create an External Client App and activate MCP servers. * The MCP server you want agents to use, activated in Setup (see [Step 2](#step-2-activate-the-mcp-server)). * A Salesforce permission set that grants the connecting users access to MCP servers (see [Step 3](#step-3-grant-users-access)). ## About Scopes The External Client App needs two OAuth scopes: **Access MCP servers (mcp\_api)** and **Perform requests at any time (refresh\_token)**. What an agent can then do follows the connecting user's own Salesforce permissions, and every call is still gated by your Cakewalk Policies. ## Step 1: Create the External Client App Salesforce requires an External Client App. A classic Connected App does not work for MCP. 1. In Salesforce Setup, in the Quick Find box, enter **External Client** and select **External Client App Manager**. 2. Select **New External Client App**. 3. Enter an app name and contact email. 4. Expand **API (Enable OAuth Settings)** and select **Enable OAuth**. 5. In the Callback URL field, enter Cakewalk's redirect URI: ``` https://mcp-gateway.getcakewalk.io/api/v1/Auth/Callback ``` 6. Add the OAuth scopes **Access MCP servers (mcp\_api)** and **Perform requests at any time (refresh\_token)**. 7. Under Security, keep **Require Secret for Web Server Flow** and **Require Secret for Refresh Token Flow** selected. Select **Require Proof Key for Code Exchange (PKCE) extension** and **Issue JSON Web Token (JWT)-based access tokens for named users**. 8. Create the app. It can take up to 30 minutes to become available. ## Step 2: Activate the MCP Server The MCP server is off until you activate it in the org. 1. In Salesforce Setup, go to **API Catalog** and select **MCP Servers**. 2. Activate the server you want agents to use. **SObject All** covers full record access. **SObject Reads** covers read only. ## Step 3: Grant Users Access Access to MCP servers is gated by a permission set. 1. Create or open a permission set that includes the **Access MCP servers** permission. 2. Assign it to the users who will connect Salesforce through Cakewalk. ## Step 4: Get the Client ID and Secret 1. Open the External Client App and select **Settings**. 2. Under **OAuth Settings**, select **Consumer Key and Secret**. 3. Copy the **Consumer Key**. This is the Client ID. 4. Copy the **Consumer Secret**. This is the Client Secret. Salesforce may ask you to verify your identity before it reveals the secret. ## Step 5: Paste Credentials Into Cakewalk 1. Open . 2. Go to All Connections. 3. Find Salesforce. 4. Select Edit credentials. 5. Paste the Client ID and Client Secret. 6. Save. ## Verifying It Works The Salesforce Connection card flips to Active on All Connections. From an agent platform connected to Cakewalk, ask the agent to look up a Salesforce record. If Salesforce returns the data, the Connection is live. ## Troubleshooting * **The connection fails right after the Salesforce login and consent screen.** The MCP server is not activated in the org, or the connecting user does not have the Access MCP servers permission. Recheck [Step 2](#step-2-activate-the-mcp-server) and [Step 3](#step-3-grant-users-access). Login and consent can succeed before either is in place, so the connection only fails at the final step. * **Lost the Consumer Secret.** Reset it on the External Client App, then paste the new value into Cakewalk. * **The app was just created.** Allow up to 30 minutes before the first connection attempt. ## Learn more * [Set up Salesforce Hosted MCP Servers](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/setup-overview.html) * [Create an External Client App](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/create-external-client-app.html) * [Standard MCP servers](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/servers-reference.html) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/salesforce.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.