# Salesforce setup for PopMCP

You paste the Consumer Key and Consumer Secret of an External Client App you create in Salesforce Setup, then sign in with Salesforce and allow access.

- Auth: OAuth authorization
- Setup time: 8 min
- API base URL: https://YOUR-DOMAIN.my.salesforce.com/services/data/v68.0
- Credentials screen: https://login.salesforce.com/
- Provider docs: https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5

## Approval required before this works

Salesforce only answers API calls from orgs on an edition with API access: Enterprise, Unlimited, Performance and Developer Edition include it, and Professional Edition needs the API add-on. Your own External Client App needs no review by Salesforce and works as soon as it is saved.

- Typical wait: None on an edition with API access. Adding API access to Professional Edition goes through your Salesforce account executive, and Salesforce publishes no timeframe for it.
- Cost: Included in Enterprise, Unlimited, Performance and Developer Edition, and a Developer Edition org is free to sign up for. The Professional Edition API add-on is a paid extra that Salesforce quotes.
- Blocked until approved: Every tool on an org whose edition has no API access, and for any user without the API Enabled permission: Salesforce refuses the calls with API_DISABLED_FOR_ORG or API_CURRENTLY_DISABLED. Other editions, such as Group and Essentials, cannot add API access.
- Works meanwhile: Creating the External Client App and signing in. PopMCP checks the org right after sign-in and says whether the edition or the user's API Enabled permission is what is missing.

## Before you begin

- A Salesforce org on Enterprise, Unlimited, Performance or Developer Edition, or Professional Edition with the API add-on. A free Developer Edition org works for trying it out.
- A Salesforce user with the API Enabled permission. System Administrators have it; other users get it from their profile or a permission set.
- An administrator to create the External Client App. To connect a sandbox, create the app while signed in to that sandbox.
- PopMCP's callback URL from the connect form: https://app.popmcp.com/api/providers/salesforce/callback

## Get your credentials

### 1. Open External Client App Manager in Setup

Sign in to Salesforce as an administrator of the org you want to connect. Click the gear icon, then Setup. Type `External Client App Manager` into Quick Find, open it, and click New External Client App.

Screen: https://login.salesforce.com/

### 2. Name the app and keep it Local

Under Basic Information, enter `PopMCP` as the External Client App Name (the API Name fills itself in) and your email as the Contact Email. Leave Distribution State on Local: the app only needs to work in this org.

### 3. Turn on OAuth and add PopMCP's callback URL

Expand API (Enable OAuth Settings) and tick Enable OAuth. Under App Settings, paste `https://app.popmcp.com/api/providers/salesforce/callback` into Callback URL. In OAuth Scopes, move Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access) to the selected list.

### 4. Keep the security options on and create the app

Nothing under Flow Enablement needs ticking: PopMCP uses the standard sign-in flow. Under Security, keep Require secret for Web Server Flow, Require secret for Refresh Token Flow and Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows ticked. Enable Refresh Token Rotation can stay on, since PopMCP stores every new token. Click Create.

### 5. Check who may sign in and how long access lasts

Open the app's Policies tab and click Edit. Set Permitted Users to All users may self-authorize. Set Refresh Token Policy to Refresh token is valid until revoked so the connection does not expire. If your org limits logins by IP address, set IP Relaxation to Relax IP restrictions, because PopMCP calls Salesforce from its own servers. Click Save.

### 6. Copy the Consumer Key and Consumer Secret

Open the Settings tab, expand OAuth Settings and click Consumer Key and Secret. Salesforce may email you a verification code first. Copy the Consumer Key (it starts with `3MVG`) and the Consumer Secret. A new app can take up to 10 minutes before Salesforce accepts it.

### 7. Paste both values into PopMCP and sign in with Salesforce

In PopMCP, paste the values into Consumer Key and Consumer Secret. Leave Salesforce login address empty for a production or Developer Edition org, type `sandbox` for a sandbox, or paste your My Domain address if your company signs in only through it. Click Sign in with Salesforce, log in, and click Allow.

## Fields PopMCP asks for

- Salesforce login address (loginUrl): For a sandbox type sandbox. If your company signs in only through its own address, paste it (it ends in .my.salesforce.com); any Salesforce page address of yours works too.
- Consumer Key (clientId) [required]: From your External Client App: Settings, OAuth Settings, Consumer Key and Secret.
- Consumer Secret (clientSecret) [required]: Shown next to the Consumer Key. Stored encrypted and used only on the server.

## Callback URL to register

https://app.popmcp.com/api/providers/salesforce/callback

## Scopes requested

- api
- refresh_token

## Verify

PopMCP shows Salesforce as Connected under your org's name (with (sandbox) after it for a sandbox), salesforce_get_org_limits returns DailyApiRequests with its Max and Remaining, and salesforce_describe_object for Account lists the fields your user can see.

## Troubleshooting

### Salesforce shows OAUTH_APPROVAL_ERROR_GENERIC or "app must be installed into org"

Cause: Your org only lets installed or approved apps sign in, and the user connecting does not have the Approve Uninstalled Connected Apps permission.

Fix: Connect as a System Administrator, or have an admin install the app once from Setup, **Connected Apps OAuth Usage**, then connect again.

### Salesforce shows redirect_uri_mismatch

Cause: The app's **Callback URL** does not exactly match PopMCP's callback.

Fix: Open the app in **External Client App Manager**, edit **OAuth Settings** on the **Settings** tab, set **Callback URL** to `https://app.popmcp.com/api/providers/salesforce/callback`, save, wait a few minutes and connect again.

### "Salesforce did not accept the Consumer Key and Consumer Secret"

Cause: One of the values was mistyped, or the app was created less than about 10 minutes ago.

Fix: Copy both values again from **Settings**, **OAuth Settings**, **Consumer Key and Secret**. If the app is new, wait 10 minutes and try again.

### "This Salesforce org's edition does not include API access"

Cause: Salesforce answered API_DISABLED_FOR_ORG: the org's edition has no API access.

Fix: Enterprise, Unlimited, Performance and Developer Edition include it. On Professional Edition ask your Salesforce account executive for the API add-on.

### "Your Salesforce user does not have the "API Enabled" permission"

Cause: Salesforce answered API_CURRENTLY_DISABLED for the user who signed in.

Fix: Ask an admin to turn on **API Enabled** in your profile or a permission set, or connect as a user who has it.

### "This Salesforce user may not use the app"

Cause: The app's **Permitted Users** policy only lets admin-approved users sign in, and your profile or permission set is not on its list.

Fix: On the app's **Policies** tab set **Permitted Users** to **All users may self-authorize**, or add your profile or permission set to the app.

### A working connection stops with "Salesforce no longer accepts this connection's sign-in"

Cause: The access was revoked, it expired under the app's **Refresh Token Policy**, the user lost access to the app, or the sandbox was refreshed.

Fix: Set **Refresh Token Policy** to **Refresh token is valid until revoked** on the app's **Policies** tab, then disconnect and reconnect Salesforce.

### REQUEST_LIMIT_EXCEEDED

Cause: The org used its API request allowance for the last 24 hours, which every integration in the org shares.

Fix: Wait and retry, check what is left with salesforce_get_org_limits, and use bulk_query or bulk_load_records for large jobs instead of thousands of single calls.

---

Source: https://www.docs.popmcp.com/docs/integrations/salesforce/