Salesforce
Connect Salesforce to manage accounts, contacts, leads, deals, cases and custom objects, run reports and flows, log activity, and handle approvals.
You paste the Consumer Key and Consumer Secret of an External Client App you create in Salesforce Setup, then sign in with Salesforce and allow access.
Paid plan required before this connector works
Salesforce only answers API calls from orgs on an edition with API access: Enterprise, Unlimited, Performance and Developer Edition include it, and Professional Edition needs the API add-on. Your own External Client App needs no review by Salesforce and works as soon as it is saved.
- Typical wait
- None on an edition with API access. Adding API access to Professional Edition goes through your Salesforce account executive, and Salesforce publishes no timeframe for it.
- Cost
- Included in Enterprise, Unlimited, Performance and Developer Edition, and a Developer Edition org is free to sign up for. The Professional Edition API add-on is a paid extra that Salesforce quotes.
- Blocked until approved
- Every tool on an org whose edition has no API access, and for any user without the API Enabled permission: Salesforce refuses the calls with API_DISABLED_FOR_ORG or API_CURRENTLY_DISABLED. Other editions, such as Group and Essentials, cannot add API access.
- Works meanwhile
- Creating the External Client App and signing in. PopMCP checks the org right after sign-in and says whether the edition or the user's API Enabled permission is what is missing.
Where to apply: Nothing to apply for on an edition with API access. For Professional Edition, ask your Salesforce account executive for the API add-on. A user without API Enabled needs an admin to turn it on in their profile or a permission set.
- An org that blocks apps it has not installed refuses the first sign-in with OAUTH_APPROVAL_ERROR_GENERIC. A System Administrator can connect first, or install the app once from Setup, Connected Apps OAuth Usage.
- Every call counts toward the org's daily API request allowance, the same pool its other integrations draw on. get_org_limits shows what is left.
- A new External Client App can take a few minutes to reach every Salesforce server, so a sign-in right after saving it can fail. Wait a few minutes and try again.
- A sandbox signs in at test.salesforce.com, so type sandbox in the login address field. Refreshing a sandbox ends its connection; reconnect after a refresh.
- Since Spring '26 new connected apps cannot be created without Salesforce Support, so create an External Client App instead.
- Setup time
- 8 min
- Auth
- OAuth authorization
- API base URL
- https://YOUR-DOMAIN.my.salesforce.com/services/data/v68.0
- Rate limits
- Each org gets a rolling 24-hour allowance of API requests that all its integrations share: 15,000 on Developer Edition, and 100,000 plus a per-license amount on Enterprise, Unlimited and Performance (1,000 per Salesforce license on Enterprise, 5,000 on Unlimited and Performance). In production at most 25 requests that run for 20 seconds or longer can be open at once.
Before you begin
- A Salesforce org on Enterprise, Unlimited, Performance or Developer Edition, or Professional Edition with the API add-on. A free Developer Edition org works for trying it out.
- A Salesforce user with the API Enabled permission. System Administrators have it; other users get it from their profile or a permission set.
- An administrator to create the External Client App. To connect a sandbox, create the app while signed in to that sandbox.
- PopMCP's callback URL from the connect form: https://app.popmcp.com/api/providers/salesforce/callback
Get your credentials
Open External Client App Manager in Setup
Sign in to Salesforce as an administrator of the org you want to connect. Click the gear icon, then Setup. Type External Client App Manager into Quick Find, open it, and click New External Client App.
External Client App Manager
Apps that sign in to this org with OAuth.
| External Client App Name | Distribution State | Created |
|---|---|---|
| Data Loader syncops@acme.com | Local | Mar 4, 2026 |
Quick Find searches the Setup menu, so typing External is enough to find it.
Name the app and keep it Local
Under Basic Information, enter PopMCP as the External Client App Name (the API Name fills itself in) and your email as the Contact Email. Leave Distribution State on Local: the app only needs to work in this org.
New External Client App
Basic Information
Turn on OAuth and add PopMCP's callback URL
Expand API (Enable OAuth Settings) and tick Enable OAuth. Under App Settings, paste https://app.popmcp.com/api/providers/salesforce/callback into Callback URL. In OAuth Scopes, move Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access) to the selected list.
New External Client App
API (Enable OAuth Settings)
| Selected OAuth Scopes |
|---|
| Manage user data via APIs (api) |
| Perform requests at any time (refresh_token, offline_access) |
Salesforce compares the callback URL character for character, so copy it from the PopMCP connect form.
Keep the security options on and create the app
Nothing under Flow Enablement needs ticking: PopMCP uses the standard sign-in flow. Under Security, keep Require secret for Web Server Flow, Require secret for Refresh Token Flow and Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows ticked. Enable Refresh Token Rotation can stay on, since PopMCP stores every new token. Click Create.
New External Client App
Security
| Setting | Value |
|---|---|
| Require secret for Web Server Flow | On |
| Require secret for Refresh Token Flow | On |
| Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows | On |
| Enable Refresh Token Rotation | On or off |
Check who may sign in and how long access lasts
Open the app's Policies tab and click Edit. Set Permitted Users to All users may self-authorize. Set Refresh Token Policy to Refresh token is valid until revoked so the connection does not expire. If your org limits logins by IP address, set IP Relaxation to Relax IP restrictions, because PopMCP calls Salesforce from its own servers. Click Save.
PopMCP
External Client App
- Permitted Users
- All users may self-authorize
- Refresh Token Policy
- Refresh token is valid until revoked
- IP Relaxation
- Relax IP restrictions
Copy the Consumer Key and Consumer Secret
Open the Settings tab, expand OAuth Settings and click Consumer Key and Secret. Salesforce may email you a verification code first. Copy the Consumer Key (it starts with 3MVG) and the Consumer Secret. A new app can take up to 10 minutes before Salesforce accepts it.
PopMCP
External Client App
- Consumer Key
- 3MVG9****Xq2T
- Consumer Secret
- 7F3A****C91D
Keep the secret private: anyone holding both values can send your users to sign in as this app.
Paste both values into PopMCP and sign in with Salesforce
In PopMCP, paste the values into Consumer Key and Consumer Secret. Leave Salesforce login address empty for a production or Developer Edition org, type sandbox for a sandbox, or paste your My Domain address if your company signs in only through it. Click Sign in with Salesforce, log in, and click Allow.
Connect in PopMCP
Open your workspace, choose Salesforce in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Salesforce login addresstext | For a sandbox type sandbox. If your company signs in only through its own address, paste it (it ends in .my.salesforce.com); any Salesforce page address of yours works too. |
| Consumer Keytext | From your External Client App: Settings, OAuth Settings, Consumer Key and Secret. |
| Consumer Secretsecret | Shown next to the Consumer Key. Stored encrypted and used only on the server.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/salesforce/callbackOnly for your own app: in Salesforce open Setup, External Client App Manager, New External Client App, turn on Enable OAuth, and paste this exact URL as the Callback URL.
PopMCP verifies the credential against Salesforce immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Salesforce at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| api | Manage user data via APIs. Every call PopMCP makes for the AI needs it: records, SOQL and SOSL, composite requests, Bulk API, reports and dashboards, flows and actions, approvals, Tooling, UI API, Chatter and files, and CRM Analytics. What it reaches is still limited by the signed-in user's profile, permission sets and sharing. |
| refresh_token | Perform requests at any time (refresh_token, offline_access). Lets PopMCP renew the session when it times out, so you do not have to sign in again. Without it the connect stops with a message saying the scope is missing. |
Verify it worked
PopMCP shows Salesforce as Connected under your org's name (with (sandbox) after it for a sandbox), salesforce_get_org_limits returns DailyApiRequests with its Max and Remaining, and salesforce_describe_object for Account lists the fields your user can see.
Troubleshooting
Salesforce shows OAUTH_APPROVAL_ERROR_GENERIC or "app must be installed into org"
Why: Your org only lets installed or approved apps sign in, and the user connecting does not have the Approve Uninstalled Connected Apps permission.
Fix: Connect as a System Administrator, or have an admin install the app once from Setup, **Connected Apps OAuth Usage**, then connect again.
Salesforce shows redirect_uri_mismatch
Why: The app's **Callback URL** does not exactly match PopMCP's callback.
Fix: Open the app in **External Client App Manager**, edit **OAuth Settings** on the **Settings** tab, set **Callback URL** to `https://app.popmcp.com/api/providers/salesforce/callback`, save, wait a few minutes and connect again.
"Salesforce did not accept the Consumer Key and Consumer Secret"
Why: One of the values was mistyped, or the app was created less than about 10 minutes ago.
Fix: Copy both values again from **Settings**, **OAuth Settings**, **Consumer Key and Secret**. If the app is new, wait 10 minutes and try again.
"This Salesforce org's edition does not include API access"
Why: Salesforce answered API_DISABLED_FOR_ORG: the org's edition has no API access.
Fix: Enterprise, Unlimited, Performance and Developer Edition include it. On Professional Edition ask your Salesforce account executive for the API add-on.
"Your Salesforce user does not have the "API Enabled" permission"
Why: Salesforce answered API_CURRENTLY_DISABLED for the user who signed in.
Fix: Ask an admin to turn on **API Enabled** in your profile or a permission set, or connect as a user who has it.
"This Salesforce user may not use the app"
Why: The app's **Permitted Users** policy only lets admin-approved users sign in, and your profile or permission set is not on its list.
Fix: On the app's **Policies** tab set **Permitted Users** to **All users may self-authorize**, or add your profile or permission set to the app.
A working connection stops with "Salesforce no longer accepts this connection's sign-in"
Why: The access was revoked, it expired under the app's **Refresh Token Policy**, the user lost access to the app, or the sandbox was refreshed.
Fix: Set **Refresh Token Policy** to **Refresh token is valid until revoked** on the app's **Policies** tab, then disconnect and reconnect Salesforce.
REQUEST_LIMIT_EXCEEDED
Why: The org used its API request allowance for the last 24 hours, which every integration in the org shares.
Fix: Wait and retry, check what is left with salesforce_get_org_limits, and use bulk_query or bulk_load_records for large jobs instead of thousands of single calls.
Reference
Pipedrive
Connect Pipedrive to manage deals, leads, persons, organizations, products, activities, notes, and pipelines. MCP setup guide for Claude and ChatGPT.
Zernio
Connect Zernio to schedule and publish posts across social networks, manage a unified inbox, and track analytics. MCP setup guide for Claude and ChatGPT.