Skip to main content
The Salesforce connector signs in through a connected app in your own org, so no Danube-owned app has to be installed. It supports the client credentials flow (no user token needed) and the refresh token flow.

​
Tools

​
Safety

  • Read-only. Every tool reads: SOQL goes to the Query resource, which cannot write, and only a query starting with SELECT is sent. There is no write tool. The integration user’s permissions are the second guarantee, and Test Connection warns about Modify All Data.
  • Your app, your user. The access token is requested for each call from your org’s own token endpoint and never stored.
  • Limits on every call. 15 s timeout by default (up to 55 s with timeout_seconds), 500 records (up to 5,000 with max_rows) and 1 MB per result. A cut result has truncated: true. Each page of up to 2,000 records costs one request against your daily limit.
  • No secrets in results. The consumer secret, refresh token and access token are removed from every error message.

​
Create a read-only integration user and connected app

  1. Integration user. In Setup, create a user with the Salesforce Integration license and the Minimum Access - API Only Integrations profile, or any profile without Modify All Data.
  2. Permission set. Create a permission set with API Enabled, and grant Read (plus View All only where agents need every record) on the objects agents should see. Assign it to the integration user.
  3. Connected app. In App Manager, click New Connected App (or New External Client App), enable OAuth, add the scope Manage user data via APIs (api) (and Perform requests at any time (refresh_token, offline_access) for the refresh token flow), and save.
  4. Client credentials flow. In the app’s policies, check Enable Client Credentials Flow and set Run As to the integration user. Copy the Consumer Key and Consumer Secret from Manage Consumer Details.
For the refresh token flow instead, authorize the app once as the integration user and store the refresh token it returns.

​
Connect

Open Salesforce in the dashboard’s tool catalog and click Connect, or let the agent call store_credential. Fill in:
  • My Domain URL, such as https://yourcompany.my.salesforce.com (a sandbox: https://yourcompany--sandbox.sandbox.my.salesforce.com);
  • Sign-in flow: client credentials or refresh token;
  • Consumer key and Consumer secret, and the Refresh token for that flow;
  • API version only to pin one other than v61.0.
Salesforce is a public service, so the connection is direct. If your org restricts login IP ranges for the integration user’s profile, allow Danube’s egress addresses: see Connect your production database safely.
Run Test Connection after saving. auth_required means the consumer key, secret or refresh token was refused; a bad_request naming the sign-in flow means the client credentials flow is not enabled on the app or has no Run As user.

​
Example prompts

  • “Which open opportunities over $50k close this quarter, and who owns them?”
  • “Describe the Case object and list the picklist values of Status.”
  • “Show me account 001... with its owner and its five most recent cases.”
  • “How many leads were created per source in the last 30 days?”