Salesforce Connection

Learn how to configure a Salesforce Connection for Infisical.

Infisical supports the OAuth 2.0 Client Credentials flow to connect with your Salesforce org.

Configure a Connected App in Salesforce

1. Open Settings

   In the top-right corner, click the gear icon.

   

   Click the Setup option.

   
2. Create a Connected App

   In Salesforce Setup, search for External Client App Manager and select it from the results.

   

   Click New External Client App.

   

   Provide a name, API name, and contact email.

   
3. Enable OAuth Settings

   Under API (Enable OAuth Settings):

   • Check Enable OAuth.

   • Provide a callback URL.

     The callback URL is only used by Salesforce’s OAuth Web Server Flow. Since this External Client App is used solely to rotate secrets via the Client Credentials Flow, the callback URL is never invoked — any valid URL (e.g. https://localhost) works.

   • Add the OAuth scopes your integration requires. For secret rotation, you must select Manage user data via APIs (api).

   • Check Enable Client Credentials Flow and Enable Token Exchange Flow (along with the sub-option Require secret for Token Exchange Flow).

     

   Under Security, enable Require secret for Web Server Flow and Require secret for Refresh Token Flow.

   Save the Connected App by clicking Create. It may take a few minutes for the new app to become available.

   
4. Configure the Policies

   Go back to the External Client App Manager page and select the External Client App you just created. To do this, search again for External Client App Manager.

   

   Click the app you just created, select the Policies tab, and click Edit.

   

   Under the OAuth Policies section, check Enable Client Credentials Flow and provide a username under Run As (Username) to specify which user the flow runs as.

   
5. Copy the Consumer Key and Consumer Secret

   Back on the Settings tab, go to the OAuth Settings section and click Consumer Key and Secret to open a new page where the values are displayed.

   

   Copy both the Consumer Key and Consumer Secret for later.

   
6. Enable access to External Client App Consumer

   Search again for External Client Apps and click the Settings sub-option. Under External Client App Settings, enable Allow access to External Client App consumer secrets via REST API.

   
7. Identify Your My Domain URL

   In Salesforce Setup, search for My Domain.

   

   Copy the Current My Domain URL (e.g. my-org.my.salesforce.com). This is your instance URL.

   

Setup Salesforce Connection in Infisical

Infisical UI

1. Navigate to App Connections in your organization or project.

2. Select the Salesforce Connection option.

   

3. Enter your Instance URL, Consumer Key, and Consumer Secret from the previous section, then click Connect to Salesforce.

   

4. Your Salesforce Connection is now available for use.

   

API

To create a Salesforce Connection, make an API request to the Create Salesforce Connection API endpoint.

Sample request

Request

curl    --request POST \
--url https://app.infisical.com/api/v1/app-connections/salesforce \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-salesforce-connection",
    "method": "client-credentials",
    "credentials": {
        "instanceUrl": "my-org.my.salesforce.com",
        "consumerKey": "...",
        "consumerSecret": "..."
    }
}'

Sample response

Response

{
    "appConnection": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "my-salesforce-connection",
        "version": 1,
        "orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "createdAt": "2026-05-04T05:31:56Z",
        "updatedAt": "2026-05-04T05:31:56Z",
        "app": "salesforce",
        "method": "client-credentials",
        "credentials": {
            "instanceUrl": "my-org.my.salesforce.com"
        }
    }
}