# Salesforce

![Image 1 of 1](https://assets.relyanceuat.xyz/images/docs/34547031546381/34547058666893.png)
Salesforce is a cloud-based software company that provides customer relationship management (CRM) services. It provides CRM software and applications focused on sales, customer service, marketing automation, analytics, and application development.

The Salesforce integration property scan examines both standard and custom objects. If the scope is to only scan the data, the Standard API integration Profile can be used. Read only permissions across other objects can be provided via permission sets or any other existing read-only Salesforce profile.

If the DSR functionality is being used, Modify/Delete permissions would need to be provided to this integration user for the objects from which deletion/updates will occur

#### **Choose an authentication method**

Relyance supports five, and the difference that matters is whether the connection
holds a **refresh token** or authenticates server-to-server:

| Method | Authorises as | Needs re-authorising? |
| --- | --- | --- |
| **OAuth Client Credentials** (recommended) | a Connected App, server to server | No — no user, no refresh token |
| **Oauth2 / App Token** | the user who clicked Authorize | Yes, when the refresh token is invalidated |
| **Customer OAuth** | the user who clicked Authorize, on your own Connected App | Yes |
| **Sandbox Oauth2** / **Customer OAuth Sandbox** | as above, against `test.salesforce.com` | Yes |

**Use OAuth Client Credentials unless you cannot.** The user-authorised methods
depend on a refresh token that Salesforce invalidates when the authorising user's
password changes, when their session policy expires it, when an admin revokes the
app's access, or when that person leaves — none of which is a change to the
Relyance side, and all of which present as a connection that worked for weeks and
then stopped. It also ties the data Relyance can see to one person's permissions.

Every method takes **Maximum Number of Records** (required; defaults to 5000) and
an optional **SObject Configuration** naming which objects are treated as
contracts.

Steps for the two most common:

- [OAuth Client Credentials - Two Leg Oauth 2 (Recommended)](#h_01KYJJPAJWY0ZZ03KVH0HZKNQV)
- [OAuth2 / App Token](#h_01KYJJN5KCXB6880YQ6P4H6M24)

#### OAuth Client Credentials - Two Leg Oauth 2 (Recommended)

In order to integrate Relyance AI with Salesforce using the **OAuth Client Credentials Flow**, you will need:

- An **Integration User** (Run-as user) with **API Enabled permissions**
- **Domain** (from your Salesforce instance)
- **Client ID** (generated in Salesforce)
- **Client Secret** (generated in Salesforce)

The Client Credentials Flow is an OAuth 2.0 mechanism that allows Relyance AI (the client application) to authenticate directly with Salesforce using a **client_id** and **client_secret** instead of a user-based login. This ensures secure, server-to-server communication without requiring interactive user consent.

**In Salesforce**

1. Login to your Salesforce account.
2. Copy your **Salesforce subdomain** from the browser URL (you will need this later).

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/47686509203853.png)

3. **Go to Setup** on the **Search Setup** search for **App Manager.**
4. Under **External Client Apps**, select External Client App, and click **New External Client App**.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/47686554914189.png)

5. In the **Basic Information** section, provide:
    - **Connected App Name**: e.g., `Relyance Scan`
    - **API Name**: auto-fills
    - **Contact Email**: an email you have access to (a verification code will be sent here in a later step).
6. In the **API (Enable OAuth Settings)** section:
    - Check **Enable OAuth Settings**.
    - **Callback URL**: `https://root.relyance.ai/api/oauth2` (required by the form but unused by the Client Credentials flow).
    - Under **Selected OAuth Scopes**, add:
        - `Manage user data via APIs (api)`
        - `Perform requests at any time (refresh_token, offline_access)`
7. Under **Flow Enablement**, check **Enable Client Credentials Flow**.
8. In the **Security** section:
    - Uncheck **Require Proof Key for Code Exchange (PKCE)**.
    - Leave **Require Secret for Web Server Flow** and **Require Secret for Refresh Token Flow** checked.
9. Click **Save**. Wait 2–10 minutes for the app to propagate before continuing.
10. Edit the app once created by going to the app and on the **Policies** tab, click **Edit**.
11. Under **OAuth Policies**:
    - **Permitted Users**: `Admin approved users are pre-authorized` (recommended).
    - **IP Relaxation**: `Relax IP restrictions` (unless you have allowlisted Relyance's egress IPs).
12. Under **OAuth Flows and External Client App Enhancements** select **Enable Client Credentials Flow**
13. This will open up a **Run As (Username)** input box, enter the ***email address*** of the preconfigured integration user.
14. Two boxes will appear in the App Policies section. In **Profiles**, select the profile assigned to the preconfigured integration user. In **Permission Sets**, select the permission sets that user requires.
15. Click **Save**.
16. Click on the **Settings** tab and scroll to the **OAuth Settings** section. Click on the **Consumer Key and Secret** button - this will send a verification code to the apps configured email address.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/47686554915597.png)

**In Relyance AI**

1. **Login** to your Relyance AI account.
2. Navigate to the **Settings Menu** (bottom left-hand side).
3. Select **Integrations**.
4. Find **Salesforce** in the integration catalog and click **Add Integration**.
5. Provide a **Connection Name**.
6. Go through the wizard and continue with the recommended settings
7. Select **OAuth Client Credentials** as the connection type.
8. Enter the **Domain**, **Client ID**, and **Client Secret** obtained from the Salesforce setup above.
9. Click **Authenticate**
10. Once authentication is successful, click **Finish**.
11. **Congratulations!** You are now connected to Salesforce.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/47686509208077.png)

#### OAuth2 / App Token

To integrate Salesforce with Relyance AI, you will need to follow an **OAuth2** flow.

##### Permissions

The Salesforce OAuth user will need the following permissions:

- api
- refresh_token
- custom_objects
- connected_apps (for Vendor Discovery)

Please see the integration information section on the configuration page for associated endpoints.

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Salesforce** integration card and click on it.
5. Click on the **Add Connection** button on the top right
6. Provide a meaningful name for the integration and click on the **Add** button
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see [Integration Features](/docs/introduction-to-relyance-ai/integration-features/).
8. In the **Connection** section, provide the appropriate values and click on **Continue**.
    - **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual Maps**, **Assets**, and **Data Flow Analysis** pages.
    - **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    - **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/).
9. In the Authentication section, select **Oauth2/App token** and click on **Continue**  Login to Salesforce and follow any prompts to accept the connection.
10. **If the Data Inspection check box is checked from step 7,** in the Data Inspection section, provide the appropriate values and click on **Continue**
    - **Minimum Confidence Level:** This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.
11. Review the configuration summary from the Completion section and click on **Finish**.
12. Confirm the integration Status reflects **Connected**

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/34547031532173.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/34547058669069.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/40707719996813.png)

![Salesforce-2.png](https://assets.relyanceuat.xyz/images/docs/34547031546381/34547058671117.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/34547031542029.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/34547031542797.png)

#### Other

For **Customer OAuth** method of authentication provide the **Client ID and Client secret** and click on **Continue**. Refer to the [documentation](https://support.relyance.ai/hc/en-us/article_attachments/39633972319117) on steps to configure connected apps to retrieve the Client ID and Client Secret.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34547031546381/40707736601741.png)

### Check the connection after setup

Open the connection to see what Relyance is authorised for and what the last scan
actually covered — a missing scope or a partial grant shows up here rather than as
an error:

![A connection's detail view: what Relyance is authorised for, and what the last scan covered](https://assets.relyanceuat.xyz/images/docs/ui/salesforce/08-connection-detail.png)

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### OAuth (browser authorization)

The **OAuth (browser authorization)** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example salesforce/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth (browser authorization) — Sandbox Oauth2

The **OAuth (browser authorization) — Sandbox Oauth2** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example salesforce/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth (browser authorization) — Customer OAuth

The **OAuth (browser authorization) — Customer OAuth** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example salesforce/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth (browser authorization) — Customer OAuth Sandbox

The **OAuth (browser authorization) — Customer OAuth Sandbox** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example salesforce/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth client credentials

```hcl
resource "relyance_integration_connection" "salesforce_4" {
  vendor = "salesforce"
  name   = "<your connection name>"

  auth = {
    method = "oauth-client-credentials"
    params = {
      domain = "<domain>"
      maximum_number_of_records = "5000"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      client_id = var.salesforce_client_id
      client_secret = var.salesforce_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->