Skip to main content
The Salesforce integration connects your Salesforce org to Aperium so agents can read Accounts, Contacts, Leads, Opportunities, and the org’s full SObject schema, and — with approval — write records and manage custom fields. The primary connection is admin-managed: an admin configures a Connected App once with the OAuth 2.0 client-credentials grant, and every user reaches Salesforce through that shared integration user, subject to your access-control policies. Users can optionally link their own Salesforce login instead (see Optional: per-user login).

​
What agents can do

Read

  • Records & schema — discover objects, describe fields, read single records
  • Query — typed SOQL queries, SOSL text search, and read any SObject (standard or custom) as a dataset
  • Sales analytics — account overview, opportunity detail with documents and competitors, recent activity, and pipeline-readiness assessment
  • Search — opportunities, opportunity stage history, and leads

Write — approval-gated

  • Records — insert, update, delete, and upsert records (up to 200 per call)
  • Field admin — create and update custom fields through the Tooling API
Every write tool is approval-gated. When an agent proposes a record change or a custom-field edit, Aperium pauses and shows the exact change for a human to approve before it reaches Salesforce. Reads run without a prompt.
Salesforce queries are built through typed SOQL / SOSL models, never string concatenation, which closes the injection vectors of hand-built queries. Creating whole custom objects is not supported — the Tooling REST API cannot create a CustomObject, so only custom-field admin is exposed.

​
What you’ll need

Before configuring the connection, your Salesforce admin should have:
1

A registered Connected App

A Salesforce Connected App configured for the auth method you choose. The admin-managed path needs the client-credentials grant with a run-as integration user. The app supplies a consumer key (Client ID) and consumer secret (Client Secret).
2

API access enabled

Whoever the tokens act as needs API access and the right object permissions for the records the agent will read and write — the integration user for the client-credentials path, or each connecting user’s profile / permission set for per-user login.

​
Setup

1

Open the Salesforce setup form

In Aperium, go to the admin onboarding flow (first sign-in) or the Admin Console’s MCP Servers tab (any time after), open the CRM category, and choose Salesforce. The Connect Salesforce credential page opens.
2

Fill in the connection details

On the client-credentials tab, enter:
  • Instance URL. Your org’s My Domain URL (for example https://acme.my.salesforce.com). Use the org’s own instance URL, not login.salesforce.com or test.salesforce.com; it must match the instance_url Salesforce returns in the OAuth token response.
  • Client ID. The OAuth consumer key issued for the Connected App.
  • Client Secret. The matching consumer secret.
  • Token Endpoint. Optional. Leave blank to derive it from the Instance URL ({instance_url}/services/oauth2/token); override only if your org uses a custom token endpoint.
3

Enable the connection

Click Enable. Aperium exchanges the client credentials for a token to confirm the setup, then makes the Salesforce tools available to your users under your access-control policies.

​
Optional: per-user login

Instead of (or alongside) the admin-managed integration user, Salesforce can be connected with OAuth 2.0 user login, where each user links their own Salesforce account and the agent acts with that user’s own permissions. This path uses the authorization-code flow with PKCE and needs the Connected App configured with the web-server flow, the api and refresh_token scopes, and this deployment’s callback URL. The JWT-bearer flow is not exposed by the setup form.

​
Notes

  • Production or sandbox. The connection targets one org, chosen by the Instance URL you enter — point it at your production org’s My Domain URL or a sandbox org’s URL as needed.
  • Two ready-made agents. Salesforce ships a pipeline analyst and an account analyst agent, both focused on the composite sales-analytics tools.
  • Bulk limits. Record writes go through the REST API and are capped at 200 records per call; larger loads belong in Salesforce’s Bulk API, which is out of scope here.