---
title: "How do I connect Salesforce?"
description: "TL;DR: To let Ballet pull live Salesforce data (Opportunity, Contract, Line Items, Contact Roles, and more), create a Salesforce Connected App with OAuth 2.0 Client Credentials Flow, set a Run As integration user, and share your My Domain URL plus Consumer Key and Secret. Use a Flow HTTP callout instead when Salesforce only needs to push events into a Ballet webhook."
canonical_url: "https://docs.ballet.dev/articles/how-do-i-connect-salesforce-QAssnBoCFT"
md_url: "https://docs.ballet.dev/articles/how-do-i-connect-salesforce-QAssnBoCFT.md"
---
# How do I connect Salesforce?

TL;DR: To let Ballet pull live Salesforce data (Opportunity, Contract, Line Items, Contact Roles, and more), create a Salesforce Connected App with **OAuth 2.0 Client Credentials Flow**, set a Run As integration user, and share your My Domain URL plus Consumer Key and Secret. Use a Flow HTTP callout instead when Salesforce only needs to **push** events into a Ballet webhook.

Back to: [How do I connect CRM and support tools?](/articles/how-do-i-connect-crm-and-support-tools-5h3LJzY5x8)

## Which setup do you need?

This article focuses on **outbound API**. The inbound path is summarized at the end.

## Outbound API: Connected App (Client Credentials)

### What you will need

* Salesforce System Administrator access (or equivalent)

* Permission to create a Connected App (or External Client App)

* A dedicated Salesforce integration user (recommended)

* About 15–20 minutes

### What you will share with Ballet

Share the Consumer Secret through a secure channel.

### Step 1: Create an integration user

1. In Salesforce, open **Setup**.
2. Go to **Users → Users → New User**.
3. Create a user such as `Ballet Integration`.
4. Assign a profile or permission set that includes **API Enabled** and read access to the objects and fields Ballet needs.
5. Make sure the user is **Active**.

Use least privilege where possible.

### Step 2: Create the Connected App

1. In **Setup**, go to **App Manager**.
2. Click **New Connected App**. If your org shows **New External Client App**, use that instead.
3. Enter **Connected App Name:** `Ballet`, leave the API Name default, and set your admin **Contact Email**.
4. Under **API (Enable OAuth Settings)**:

   * Select **Enable OAuth Settings**

   * Set **Callback URL** to `https://api.ballet.dev/auth/salesforce/callback` (required by Salesforce; unused for Client Credentials)

   * Select **Enable Client Credentials Flow**

   * Under **Selected OAuth Scopes**, add only **Manage user data via APIs (**`api`)
5. Do **not** add `Perform requests at any time (refresh_token, offline_access)` — that scope breaks Client Credentials.
6. Click **Save** and wait a few minutes for activation.

### Step 3: Set the Run As user

1. In **Setup**, go to **Manage Connected Apps**.
2. Open the `Ballet` Connected App and click **Edit Policies**.
3. Under **Client Credentials Flow**, set **Run As** to your integration user.
4. If available, set **Permitted Users** to **Admin approved users are pre-authorized**.
5. Assign the integration user's permission set to the Connected App if prompted, then **Save**.

If this step is skipped, authentication fails with: `invalid_grant: no client credentials user enabled`

### Step 4: Copy the Consumer Key and Secret

1. Open the Connected App → **Manage Consumer Details**.
2. Complete identity verification if prompted.
3. Copy **Consumer Key** (Client ID) and **Consumer Secret** (Client Secret).

Treat the Consumer Secret like a password. Store it in Ballet [Secrets](/articles/how-do-i-store-credentials-with-secrets-1D8OUcCo0n).

### Step 5: Find your My Domain URL

1. In **Setup**, search for **My Domain**.
2. Copy your org URL (Production: `https://yourcompany.my.salesforce.com`, Sandbox: `https://yourcompany--partial.sandbox.my.salesforce.com`).

### Step 6: Optional connection test

```bash
curl -X POST "https://YOUR_MY_DOMAIN/services/oauth2/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CONSUMER_KEY" \
  -d "client_secret=YOUR_CONSUMER_SECRET"
```

A successful response includes an `access_token`.

<br />

***

## Outbound API: Pipedream Single Sign-On (SSO)

### What you will need

* Salesforce System Administrator access to install packages for the initial sign in.
* About 5 minutes

### Step 1: Connect using the built-in Salesforce connector

1. In Ballet → Connectors, search for **Salesforce**.
2. Select **Sign in with Salesforce** option.

### Step 2: Install Pipedream package

1. When the pop up shows up, press **Continue**.
2. On the second page, click the link to install the package in your org.

   ![](https://docs.ballet.dev/api/attachments.redirect?id=2777ec44-3183-4c46-aee6-bfd4b0fd4238 " =335x456")
3. You will be redirected to Salesforce. Select **Install for All Users** and install the package.

![](https://docs.ballet.dev/api/attachments.redirect?id=7e112f9f-4761-480a-a2a3-adb4303ca6b5 " =1073x704")

### Step 3: Verify package installation

1. In Salesforce, navigate to Setup → Search and look for **Installed Packages** *and verify that Pipedream is installed.*

![](https://docs.ballet.dev/api/attachments.redirect?id=9e4d4f95-6abd-4a8a-88e3-c91f67c37cad " =1985x574")

2. In Setup, search for **External Client App Manager** and verify that Pipedream is in the list.

![](https://docs.ballet.dev/api/attachments.redirect?id=809a4c09-2bd8-4ba1-82b9-a92e893340ea " =1977x230")

***

<br />

### Step 4: Continue sign in

1. Once the package is installed, go back to Ballet and continue the sign in process.
2. You will be redirected to a Salesforce pop up - enter your credentials.
3. Once authorized, you will see this message:

![](https://docs.ballet.dev/api/attachments.redirect?id=78de8879-eed3-468c-8bff-4e67e571c387 " =328x521")

***

### Troubleshooting

### Official Salesforce references

* [OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm\&type=5)

* [Using the Client Credentials Flow for Easier API Authentication](https://developer.salesforce.com/blogs/2023/03/using-the-client-credentials-flow-for-easier-api-authentication)

* [Connected App usage restrictions (Pipedream SSO flow)](https://admin.salesforce.com/blog/2025/get-ready-for-changes-to-connected-app-usage-restrictions)

## Inbound webhook: Flow HTTP callout (optional)

Use this when Salesforce should **start** a Ballet playbook.

1. In Ballet, add a Webhook trigger and choose the **Salesforce** provider. Copy the trigger URL and store the bearer token in Secrets.
2. In Salesforce, create a Named Credential / Flow HTTP Callout pointing at that URL with Authorization `Bearer <token>`.
3. Send the record payload as JSON.

See: [How do I trigger and react to playbooks with webhooks?](/articles/how-do-i-trigger-and-react-to-playbooks-with-webhooks-DYv9XyeU51)