> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce

> Connect your AI agent to a user's Salesforce account to create or update leads, manage contacts, and automate case management.

export const TokenVaultConfigBlock = ({connectionName = "connection-name", providerName = "Provider", scopes = ["scope1", "scope2"], optionalScopes = []}) => {
  const formatScopes = scopes => {
    return scopes.map(scope => `"${scope}"`).join(", ");
  };
  const jsVariableName = `with${providerName.replace(/\s+/g, '')}Connection`;
  const pythonVariableName = `with_${connectionName.replace(/-/g, '_')}_connection`;
  return <>
      <Tabs>
        <Tab title="JavaScript" icon="js">
          <CodeBlock language="javascript" wrap="true" lines="true">
{`const auth0AI = new Auth0AI();

export const ${jsVariableName} = auth0AI.withTokenVault({
  connection: "${connectionName}",
  scopes: [${scopes.length > 0 ? `
    // Required scopes for Token Vault
    ${formatScopes(scopes)},` : ''}
    // Optional Scopes specific for your app
    ${optionalScopes.length > 0 ? `${formatScopes(optionalScopes)},` : ''} ...
  ],
  refreshToken: getAuth0RefreshToken(),
});`}
          </CodeBlock>
        </Tab>
        <Tab title="Python" icon="python">
          <CodeBlock language="python" wrap="true" lines="true">
{`auth0_ai = Auth0AI()

${pythonVariableName} = auth0_ai.with_token_vault(
    connection="${connectionName}",
    scopes=[${scopes.length > 0 ? `
        # Required scopes for Token Vault
        ${formatScopes(scopes)},` : ''}
        # Optional Scopes specific for your app
        ${optionalScopes.length > 0 ? `${formatScopes(optionalScopes)},` : ''} ...
    ],
    refresh_token=get_auth0_refresh_token,
)`}
          </CodeBlock>
        </Tab>
      </Tabs>
    </>;
};

export const IntegrationInfoBlock = ({providerName}) => {
  return <Note>
      This guide walks you through setting up the <strong>{providerName}</strong> connection in Auth0. 
      For an end-to-end example that shows how to set up your app to call third-party APIs on the user's behalf 
      using a connection like this, read the{' '}
      <a href="/ai/docs/get-started/call-others-apis-on-users-behalf">
        Call Other's APIs on User's Behalf Quickstart
      </a>.
    </Note>;
};

export const Auth0SetupBlock = ({providerName, clientIDName = "Client ID", clientSecretName = "Client Secret", scopesName = "Permissions", allowFreeFormScopes = false, allowOfflineAccess = false}) => {
  return <>
      <ol>
        <li>
          In the <a href="https://manage.auth0.com">Auth0 Dashboard</a>, go to{" "}
          <b>Authentication &gt; Social</b>.
        </li>
        <li>
          Select <b>Create Connection</b>, then choose <b>{providerName}</b>.
        </li>
        <li>Click <b>Continue</b>.</li>
        <li>
          In <b>General</b>:
          <ol type="A">
            <li>
              Enter the <b>{clientIDName}</b> and <b>{clientSecretName}</b> from
              your {providerName} OAuth app.
            </li>
            <li>
              Under <b>{scopesName}</b>, select the scope(s) required for your
              application. These determine what permissions your application can
              request from {providerName}, whether for authentication (such as
              accessing basic profile details) or for API access (such as
              connecting to the provider's APIs).<br /><br />For a Dropbox and Google social
              connection, you must select <b>Offline Access</b> in the Auth0 Dashboard, enabling
              the client application to obtain an Auth0 refresh token.
            </li>
            {allowOfflineAccess && <li>
                Under <b>{scopesName}</b>, enable <b>Offline Access</b> for the connection.
                This is required by Auth0 to obtain a refresh token from {providerName}.
              </li>}
            {allowFreeFormScopes && <li>
                Add any additional scopes your application requires in the{" "}
                <b>Additional Scopes</b> field.
              </li>}
          </ol>
        </li>
        <li>
          In <b>Purpose</b>, toggle on <b>Connected Accounts for Token Vault</b>. This lets the
          connection retrieve and securely store access tokens for external
          APIs. Learn more in{" "}
          <a href="https://auth0.com/docs/secure/tokens/token-vault/connected-accounts-for-token-vault">
            Connected Accounts for Token Vault
          </a>.
        </li>
        <li>Click <b>Create</b>.</li>
        <li>
          After creation, you are redirected to the <b>Applications</b> page.
          Select the application(s) to enable this connection for.
          <br />
          Note: In a new Auth0 tenant, you can select the <b>Default App</b>.
        </li>
        <li>
          Once you have created your {providerName} social connection, <a href="https://auth0.com/docs/authenticate/identity-providers/test-connections">test your connection</a> to ensure the setup is working correctly before using it in your application.
        </li>
      </ol>
    </>;
};

Connect your AI agent to a user's Salesforce account to create or update leads and contacts, log call and email activities, generate reports, and automate case management.

## Connect Salesforce to Auth0

<Steps>
  <Step title="Salesforce setup">
    1. Sign up for a [Salesforce Developer account](https://developer.salesforce.com/signup) or use your existing Salesforce org.
    2. In your Salesforce org, navigate to **Setup** → **Platform Tools** →  **Apps** → **App Manager**.
    3. Click **New External Client App**.
    4. Fill in the basic information:
       * **Connected App Name**: Enter a descriptive name for your integration
       * **API Name**: This will be auto-generated based on the app name
       * **Contact Email**: Your email address
    5. In the **API (Enable OAuth Settings)** section:

       * Check **Enable OAuth Settings**
       * **Callback URL**: `https://YOUR_AUTH0_DOMAIN/login/callback`

           <Info>
             You can find the **Auth0 domain** in the [Auth0 Dashboard](https://manage.auth0.com/).

             You can find this under **Applications > \[Your Application] > Settings > Basic Information > Domain**.

             If you are using the [custom domains](https://auth0.com/docs/custom-domains) feature, your Auth0 domain is the custom domain. You can find this under **Branding > Custom Domains**.
           </Info>

       * **Selected OAuth Scopes**: Add the following scopes:
         * `api` - Access and manage your data (api)
         * `refresh_token` - Perform requests on your behalf at any time (refresh\_token, offline\_access)
         * `openid` - Access your identity URL service
    6. **Important Token Configuration** (for optimal Token Vault compatibility):
       * **Require Secret for Web Server Flow**: Check this option for enhanced security
       * **Require Secret for Refresh Token Flow**: Check this option to secure token refresh operations
       * **Enable Refresh Token Rotation**: Check this option to enable rotation on each refresh
       * **Issue JSON Web Token (JWT)-based access tokens for named users**: check this option, it provides longer token validity and better performance
    7. Click **Create** and wait for the app to be created.
    8. After creation, note your **Consumer Key** (Client ID) and **Consumer Secret** (Client Secret).

    <Warning>
      **Token Configuration Important Notes**:

      * If you select **opaque** tokens instead of JWT, Token Vault will default the expiry time to 10 minutes, which may cause frequent token refreshes.
      * Ensure the `refresh_token` scope is enabled in your Connected App settings, not just requested in Auth0. Without this scope enabled on the Salesforce side, Auth0 cannot request refresh tokens.
      * Consider enabling refresh token rotation for better security practices.
    </Warning>

    To learn more about Salesforce Connected App setup, read the [Create a Connected App documentation](https://help.salesforce.com/s/articleView?id=sf.connected_app_create.htm).
  </Step>

  <Step title="Auth0 setup">
    <Auth0SetupBlock providerName="Salesforce" scopesName="Scopes" allowFreeFormScopes={true} />

    <Warning>
      **Required Scopes**: Make sure to include the following scopes in your Auth0 connection configuration:

      * `openid` - Access your identity URL service
      * `api` - Access and manage your data
      * `refresh_token` - Perform requests on your behalf at any time
      * `offline_access` - Maintain access when you're not present

      These scopes must also be enabled in your Salesforce Connected App configuration.
    </Warning>
  </Step>
</Steps>

<IntegrationInfoBlock providerName="Salesforce" />

## Token Vault configuration example

To configure the Token Vault for your Salesforce connection, you can use the following code snippet in your application:

<TokenVaultConfigBlock providerName="Salesforce" connectionName="salesforce" scopes={[]} />

## Troubleshooting

### Invalid Grant Errors

If you encounter `invalid_grant` errors with expired access/refresh tokens:

1. **Check token configuration**: Ensure your Connected App uses JWT tokens instead of opaque tokens.
2. **Verify refresh token policy**: Set the refresh token policy to "valid until revoked" in your Connected App.
3. **Scope configuration**: Confirm that the `refresh_token` and `offline_access` scopes are enabled in both your Salesforce Connected App and Auth0 connection.
4. **Token rotation**: If using refresh token rotation, ensure your application handles the new refresh token returned with each refresh request.

### Common Issues

* **Scope errors**: Ensure all required scopes are enabled in your Salesforce Connected App settings, not just requested in Auth0.
* **Token expiry**: JWT tokens have longer expiry times than opaque tokens. If using opaque tokens, expect frequent token refreshes.
* **Multiple authorizations**: Avoid authorizing the same user multiple times rapidly, as this may cause token invalidation issues.

For additional troubleshooting resources, refer to Salesforce's OAuth troubleshooting documentation and error code references.

## Next steps

* To learn how to configure applications to access Token Vault, read [Configure Token Vault](https://auth0.com/docs/secure/tokens/token-vault/configure-token-vault).
* If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations), authenticate the user with the target organization before initiating the Connected Accounts flow. Connected accounts remain linked to the individual user profile.
* To learn how to get an access token to make a tool call, complete the [Call other's APIs on user's behalf Quickstart](https://auth0.com/ai/docs/get-started/call-others-apis-on-users-behalf).