> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce

> Let agents run SOQL, describe objects and read records through your own connected app

The Salesforce connector signs in through a connected app in your own org, so no Danube-owned app has to be installed. It supports the client credentials flow (no user token needed) and the refresh token flow.

## Tools

| Tool                | What it returns                                                                                                  |
| ------------------- | ---------------------------------------------------------------------------------------------------------------- |
| **Test Connection** | The user, org ID, API version and remaining daily API requests, with a warning when the user has Modify All Data |
| **Run SOQL Query**  | Records of one SOQL `SELECT` as objects, following further pages up to the row cap, with Salesforce's full count |
| **List Objects**    | Objects the user can query, with API name, label and whether they are custom                                     |
| **Describe Object** | Fields (label, type, nullable, references, active picklist values), child relationships and record types         |
| **Get Record**      | One record by object and ID, all visible fields or only those listed                                             |

## Safety

* **Read-only.** Every tool reads: SOQL goes to the Query resource, which cannot write, and only a query starting with `SELECT` is sent. There is no write tool. The integration user's permissions are the second guarantee, and Test Connection warns about Modify All Data.
* **Your app, your user.** The access token is requested for each call from your org's own token endpoint and never stored.
* **Limits on every call.** 15 s timeout by default (up to 55 s with `timeout_seconds`), 500 records (up to 5,000 with `max_rows`) and 1 MB per result. A cut result has `truncated: true`. Each page of up to 2,000 records costs one request against your daily limit.
* **No secrets in results.** The consumer secret, refresh token and access token are removed from every error message.

## Create a read-only integration user and connected app

1. **Integration user.** In Setup, create a user with the **Salesforce Integration** license and the **Minimum Access - API Only Integrations** profile, or any profile without Modify All Data.
2. **Permission set.** Create a permission set with **API Enabled**, and grant **Read** (plus **View All** only where agents need every record) on the objects agents should see. Assign it to the integration user.
3. **Connected app.** In **App Manager**, click **New Connected App** (or **New External Client App**), enable OAuth, add the scope **Manage user data via APIs (api)** (and **Perform requests at any time (refresh\_token, offline\_access)** for the refresh token flow), and save.
4. **Client credentials flow.** In the app's policies, check **Enable Client Credentials Flow** and set **Run As** to the integration user. Copy the **Consumer Key** and **Consumer Secret** from **Manage Consumer Details**.

For the refresh token flow instead, authorize the app once as the integration user and store the refresh token it returns.

## Connect

Open **Salesforce** in the dashboard's tool catalog and click **Connect**, or let the agent call `store_credential`. Fill in:

* **My Domain URL**, such as `https://yourcompany.my.salesforce.com` (a sandbox: `https://yourcompany--sandbox.sandbox.my.salesforce.com`);
* **Sign-in flow**: client credentials or refresh token;
* **Consumer key** and **Consumer secret**, and the **Refresh token** for that flow;
* **API version** only to pin one other than `v61.0`.

<Tabs>
  <Tab title="Direct">
    Salesforce is a public service, so the connection is direct. If your org restricts login IP ranges for the integration user's profile, allow Danube's egress addresses: see [Connect your production database safely](/connectors/production-database#allowlist-danubes-addresses).
  </Tab>

  <Tab title="Data-plane agent">
    To keep the secrets inside your network, run the [data-plane agent](/organizations/data-plane) and store them as references, for example `env://SF_CLIENT_SECRET`. Salesforce then sees calls from your own egress address.
  </Tab>
</Tabs>

Run **Test Connection** after saving. `auth_required` means the consumer key, secret or refresh token was refused; a `bad_request` naming the sign-in flow means the client credentials flow is not enabled on the app or has no Run As user.

## Example prompts

* "Which open opportunities over \$50k close this quarter, and who owns them?"
* "Describe the `Case` object and list the picklist values of `Status`."
* "Show me account `001...` with its owner and its five most recent cases."
* "How many leads were created per source in the last 30 days?"