> For the complete documentation index, see [llms.txt](https://docs.appmixer.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.appmixer.com/connector-configuration/salesforce.md). # Salesforce ### Create a Salesforce application To integrate Appmixer with Salesforce, you are going to need an app in your Salesforce org. You can either create a new one or use one that already exists. Salesforce has two kinds of apps: * **External Client App** – the current app type. Since Spring '26 the *New Connected App* button is disabled in all orgs, so every new app is an External Client App. External Client Apps always require PKCE (the **Require Proof Key for Code Exchange (PKCE)** setting is checked and cannot be changed). * **Connected App** (legacy) – older apps you may already have. They keep working. Salesforce is progressively enforcing PKCE for them too. {% hint style="info" %} The Appmixer Salesforce connector uses PKCE from version **1.7.4**. With an older connector version, connecting an account through an External Client App fails with `error=invalid_request&error_description=missing required code challenge`. Upgrade the connector before following this guide. {% endhint %} #### Create an External Client App Log in to Salesforce, open **Setup** and in the left menu look up **Platform Tools -> Apps -> External Client App Manager**. Click **New External Client App**. Fill out the basic information: * **External Client App Name** and **API Name** – for example *Appmixer*. * **Contact Email** – your email. * **Distribution State** – *Local*. Expand the **API (Enable OAuth Settings)** section and tick **Enable OAuth**. Then fill out: * **Callback URL** – `https://api.acme.com/auth/salesforce/callback`, replace *api.acme.com* with the domain of your Appmixer API and keep the suffix `/auth/salesforce/callback`. * **Selected OAuth Scopes** – add at least: * *Manage user data via APIs (api)* * *Access the identity URL service (id, profile, email, address, phone)* * *Perform requests at any time (refresh\_token, offline\_access)* In **Flow Enablement**, tick **Enable Authorization Code and Credentials Flow**. In **Security**, tick **Require secret for Web Server Flow** and **Require secret for Refresh Token Flow**. Leave **Require Proof Key for Code Exchange (PKCE)** checked – the connector sends the PKCE parameters. **Refresh Token Rotation** may stay enabled as well; the connector stores the rotated token. Click **Create**. Next, open the **Policies** tab of the new app, click **Edit** and in the **OAuth Policies** section: * tick **Enable OAuth Policies**, * set **Permitted Users** to *All users may self-authorize* (or restrict it to a profile or permission set), * set **Refresh Token Policy** to *Refresh token is valid until revoked*. Save the policies. #### Getting the client id and secret Open the **Settings** tab of your External Client App, expand **OAuth Settings** and click **Consumer Key and Secret**. Salesforce may ask you for a verification code sent to your email. You should now see your client id (shown as **Consumer Key**) and secret (shown as **Consumer Secret**). #### Legacy: Connected App If your org still allows creating Connected Apps (Setup -> **External Client App Manager** -> **Settings** -> *Allow creation of connected apps*), or you already have one, the steps are similar. Look up **Platform Tools -> Apps -> App Manager** and click *New Connected App* on the top right side:

Look out for the **API (Enable OAuth Settings)** section. Tick the Enable OAuth Settings checkbox, and fill out the callback URL and scopes as shown in this screenshot:

Filling OAuth settings for your application

Check the **Require Secret for Web Server Flow**, **Require Secret for Refresh Token Flow** and **Enable Authorization Code and Credentials Flow** checkboxes. **Require Proof Key for Code Exchange (PKCE)** can be either checked or unchecked with connector 1.7.4 or newer. To get the client id and secret, go to the **App Manager**, search for your app in the list and on the dropdown in the right side click the **View** option.

In the next screen, look out for **API (Enable OAuth Settings)** section and click on the **Manage Consumer Details** button. You should see now your client id (shown as Consumer Key) and secret (shown as Consumer Secret):

Salesforce client id (Consumer Key) and secret (Consumer Secret)

### Configure Appmixer Now we can provide these values to Appmixer. Log into the Backoffice and go to the Configuration section. Create a configuration service for Salesforce as follows:

Creating configuration for Salesforce in the Backoffice

Finally, set the *clientId* (Consumer Key in Salesforce) and the *clientSecret* (Consumer Secret in Salesforce) like this:

Adding clientId and clientSecret to Appmixer

### Authentication configuration The Salesforce OAuth authentication offers several behaviors when users try to authenticate. This is the summary of the available options (taken from Salesforce [Oauth docs](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_web_server_flow.htm\&type=5)): * `login`—The authorization server must prompt the user for reauthentication, forcing the user to log in again. * `consent`—The authorization server must prompt the user for reapproval before returning information to the client. * `select_account`—If present, take one of the following actions. * If zero or one hint is available and the user is logged in, show the approval page without prompting for login. * If zero or one hint is available and the user isn’t logged in, prompt for login. * If more than one hint is available, show the account chooser. By default, we use the `login` option, but you can configure it through the Backoffice. 1. Login into the Backoffice, and go to the Services module. Then add a new service like this: ![](https://802996127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIAGKHlIqVKJe9agnFr14%2Fuploads%2Fgit-blob-0460fb0016367e748b38f44158a72423756531bf%2Fsalesforce1.png?alt=media) 2\. Add a *promptType* key, and set it to one of the supported values by Salesforce: ![](https://802996127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIAGKHlIqVKJe9agnFr14%2Fuploads%2Fgit-blob-c63707a45fd947fc53e9394a6207d74b5201e88b%2Fsalesforce2.png?alt=media) #### Login URL The default login URL is , this can be changed with a *baseUrl.*

### Troubleshooting * `missing required code challenge` when connecting an account – the app requires PKCE but the connector is older than 1.7.4. Upgrade the connector. * `invalid_client_id` or `redirect_uri_mismatch` – the Consumer Key or the callback URL in the app does not match the Appmixer configuration. The callback URL must end with `/auth/salesforce/callback`. * The account stops working after some time – check the **Refresh Token Policy** of the app; *Refresh token is valid until revoked* is the recommended setting. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.appmixer.com/connector-configuration/salesforce.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.