Salesforce
Connect your company's Salesforce org to Cakewalk so agents can query and update Salesforce records through the MCP Gateway.
Connect your company's Salesforce org to Cakewalk's MCP Gateway. Every agent tool call against Salesforce passes through the gateway and is evaluated against your Policies.
Setup Flow: Register your own app
Salesforce does not register with Cakewalk automatically. An Admin creates an External Client App in Salesforce, points its callback at Cakewalk, and pastes the Client ID and Secret into Cakewalk. Salesforce also requires you to activate the MCP server and grant users access to it. Both happen once, on the Salesforce side.
Requirements
A Salesforce System Administrator, to create an External Client App and activate MCP servers.
The MCP server you want agents to use, activated in Setup (see Step 2).
A Salesforce permission set that grants the connecting users access to MCP servers (see Step 3).
About Scopes
The External Client App needs two OAuth scopes: Access MCP servers (mcp_api) and Perform requests at any time (refresh_token). What an agent can then do follows the connecting user's own Salesforce permissions, and every call is still gated by your Cakewalk Policies.
Step 1: Create the External Client App
Salesforce requires an External Client App. A classic Connected App does not work for MCP.
In Salesforce Setup, in the Quick Find box, enter External Client and select External Client App Manager.
Select New External Client App.
Enter an app name and contact email.
Expand API (Enable OAuth Settings) and select Enable OAuth.
In the Callback URL field, enter Cakewalk's redirect URI:
Add the OAuth scopes Access MCP servers (mcp_api) and Perform requests at any time (refresh_token).
Under Security, keep Require Secret for Web Server Flow and Require Secret for Refresh Token Flow selected. Select Require Proof Key for Code Exchange (PKCE) extension and Issue JSON Web Token (JWT)-based access tokens for named users.
Create the app. It can take up to 30 minutes to become available.
Step 2: Activate the MCP Server
The MCP server is off until you activate it in the org.
In Salesforce Setup, go to API Catalog and select MCP Servers.
Activate the server you want agents to use. SObject All covers full record access. SObject Reads covers read only.
Step 3: Grant Users Access
Access to MCP servers is gated by a permission set.
Create or open a permission set that includes the Access MCP servers permission.
Assign it to the users who will connect Salesforce through Cakewalk.
Step 4: Get the Client ID and Secret
Open the External Client App and select Settings.
Under OAuth Settings, select Consumer Key and Secret.
Copy the Consumer Key. This is the Client ID.
Copy the Consumer Secret. This is the Client Secret.
Salesforce may ask you to verify your identity before it reveals the secret.
Step 5: Paste Credentials Into Cakewalk
Go to All Connections.
Find Salesforce.
Select Edit credentials.
Paste the Client ID and Client Secret.
Save.
Verifying It Works
The Salesforce Connection card flips to Active on All Connections. From an agent platform connected to Cakewalk, ask the agent to look up a Salesforce record. If Salesforce returns the data, the Connection is live.
Troubleshooting
The connection fails right after the Salesforce login and consent screen. The MCP server is not activated in the org, or the connecting user does not have the Access MCP servers permission. Recheck Step 2 and Step 3. Login and consent can succeed before either is in place, so the connection only fails at the final step.
Lost the Consumer Secret. Reset it on the External Client App, then paste the new value into Cakewalk.
The app was just created. Allow up to 30 minutes before the first connection attempt.
Learn more
Last updated
Was this helpful?