> ## Documentation Index
> Fetch the complete documentation index at: https://rollout.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce

> Choose your Salesforce environment, then approve access.

## Configure the Salesforce OAuth application

Complete this section once before users connect Salesforce accounts. You need Salesforce permission to create and manage External Client Apps.

<Steps>
  <Step title="Open External Client App Manager">
    In Salesforce **Setup**, enter **App Manager** in **Quick Find**, then open **External Client Apps → External Client App Manager**. Select **New External Client App**.

    <img src="https://mintcdn.com/rollout/geMrLesykrIZRu6I/images/end-user-guides/salesforce/external-client-app-manager.png?fit=max&auto=format&n=geMrLesykrIZRu6I&q=85&s=4d991c5fe3562be53521859aae302b51" alt="Salesforce External Client App Manager with the New External Client App button" width="1505" height="870" data-path="images/end-user-guides/salesforce/external-client-app-manager.png" />
  </Step>

  <Step title="Enter the application information">
    Enter an application name, API name, and contact email. Keep **Distribution State** set to **Local** when the app is used only by this Salesforce organization.

    <img src="https://mintcdn.com/rollout/geMrLesykrIZRu6I/images/end-user-guides/salesforce/new-external-client-app.png?fit=max&auto=format&n=geMrLesykrIZRu6I&q=85&s=deb39b901d8fb5c94861b135c2d17889" alt="Salesforce New External Client App Basic Information form" width="1050" height="500" data-path="images/end-user-guides/salesforce/new-external-client-app.png" />
  </Step>

  <Step title="Configure the callback URL and scopes">
    Expand **API (Enable OAuth Settings)** and select **Enable OAuth**. Enter this callback URL:

    ```text theme={null}
    https://universal.rollout.com/api/oauth/redirect
    ```

    Move these permissions to **Selected OAuth Scopes**:

    ```text theme={null}
    Manage user data via APIs (api)
    Perform requests at any time (refresh_token, offline_access)
    ```

    <img src="https://mintcdn.com/rollout/geMrLesykrIZRu6I/images/end-user-guides/salesforce/oauth-settings.png?fit=max&auto=format&n=geMrLesykrIZRu6I&q=85&s=d11f3d1eb3f6ee06ba41c30343fc2486" alt="Salesforce External Client App OAuth settings with the Rollout callback URL and required API and refresh-token scopes selected" width="1505" height="870" data-path="images/end-user-guides/salesforce/oauth-settings.png" />
  </Step>

  <Step title="Enable the authorization flow">
    Under **Flow Enablement**, select **Enable Authorization Code and Credentials Flow**. Keep Salesforce's required PKCE and refresh-token rotation settings enabled.

    <img src="https://mintcdn.com/rollout/geMrLesykrIZRu6I/images/end-user-guides/salesforce/oauth-flow-settings.png?fit=max&auto=format&n=geMrLesykrIZRu6I&q=85&s=b9bb87f28109f1819238a2bdf77cfb51" alt="Salesforce External Client App Flow Enablement with Authorization Code and Credentials Flow selected and PKCE enabled" width="1505" height="870" data-path="images/end-user-guides/salesforce/oauth-flow-settings.png" />
  </Step>

  <Step title="Create the app and copy its OAuth credentials">
    Select **Create**. After Salesforce creates the app, open its **Settings** tab and select **Consumer Key and Secret**. Complete Salesforce identity verification, then copy the **Consumer Key** and **Consumer Secret**.

    Use the Consumer Key as `SALESFORCE_CLIENT_ID` and the Consumer Secret as `SALESFORCE_CLIENT_SECRET` in the Rollout deployment configuration. Treat the Consumer Secret like a password.
  </Step>
</Steps>

Salesforce documents these settings in its [External Client App OAuth guide](https://help.salesforce.com/s/articleView?id=sf.configure_external_client_app_oauth_settings.htm\&language=en_US).

## Connect a Salesforce account

End users do not need to copy an API key or security token. Authorization happens in a secure Salesforce OAuth window.

<Steps>
  <Step title="Choose the Salesforce environment">
    In the Salesforce connection window, select **Prod** for a production organization or **Sandbox** for a test organization, then select **Connect Account**.

    <img src="https://mintcdn.com/rollout/geMrLesykrIZRu6I/images/end-user-guides/salesforce/connect-in-rollout.png?fit=max&auto=format&n=geMrLesykrIZRu6I&q=85&s=759ef870acdc2f7b78e172d81ef183dc" alt="Rollout test tenant Salesforce connection form with the production and sandbox environment selector" width="1133" height="400" data-path="images/end-user-guides/salesforce/connect-in-rollout.png" />
  </Step>

  <Step title="Sign into the correct organization">
    Sign in with a Salesforce user that has access to the records you want to sync. Complete Salesforce verification if prompted.
  </Step>

  <Step title="Approve access">
    Review the requested permissions and select **Allow**. The secure window returns you to the product when the connection is complete.
  </Step>
</Steps>

<Info>
  The Salesforce user must have REST API access. If authorization succeeds but the connection is rejected, ask a Salesforce administrator to check the user's edition, profile, and permission sets.
</Info>