Salesforce
Service ID: salesforce
CRM software solutions and enterprise cloud computing from Salesforce, the leader in customer relationship management (CRM) and PaaS.
At a Glance
- Difficulty
- ⚡MODERATEEdition-Gated API Access
- Authentication
- OAuth 2.0OAuth 2.0 Authorization Code flow with PKCE.
- Webhooks
- Virtual webhooks — contacts, companies, leads, opportunities, activities, notes, pipelines and users (created/updated)
- Partnership Required
- No(A free, self-service Salesforce Developer account is all you need — no partner program or app review.)
- Partnership Application
- Salesforce Developers↗
- Apideck Credentials
- AvailableThe OAuth consent screen shows "Apideck" while testing; use your own External Client App in production.
- Costs
- No Salesforce-side fees to build or test; additional daily API calls can be bought from Salesforce.
- Sandbox Availability
- Available — Access Sandbox↗(Free Developer Edition org: 2 user licenses, 5 MB data / 20 MB file storage; create more orgs as needed.)
- Account Type Required
- Salesforce edition with API access (Enterprise, Unlimited, Performance or Developer; Professional via paid add-on)
- Consumer Access Level
- User with the "API Enabled" permission (System Administrator profile includes it)
- Rate Limits
- 100,000 requests/24 hours (Enterprise) plus 1,000 per user license; 25 concurrent long-running requests.
What are Apideck credentials?
For select connectors, Apideck has established partnerships allowing you to integrate immediately without your own partnership. When using Apideck credentials, “Apideck” appears as the requesting application during OAuth. Learn more about partnership categories →
Responsibility matrix
| Task | You (Customer) | Your Consumer | Apideck |
|---|---|---|---|
| Create Salesforce Developer Account | ✓ (or use Apideck credentials) | — | — |
| Create External Client App | ✓ (or use Apideck credentials) | — | Docs provided |
| Add Credentials to Apideck | ✓ (or use Apideck credentials) | — | — |
| Authorize Connection (OAuth) | — | ✓ | Handles OAuth flow |
| Build via Unified API | ✓ | — | Maintains connector |
| Token Refresh | — | — | ✓ Automatic |
| Monitor Connections | ✓ Via Dashboard | ✓ Can revoke anytime | Logs & alerts |
Environments
- Sandbox
- Development and testing. A free Developer Edition org is standalone, ships with sample data, and authenticates via login.salesforce.com just like production. A consumer's own Salesforce sandbox (Developer, Developer Pro, Partial Copy or Full Copy of a paid org) authenticates via test.salesforce.com instead — for those the consumer selects Sandbox in the connection's Environment setting. One set of External Client App credentials is configured once in Apideck and used for both hosts — the Environment setting only chooses whether authorization goes through login.salesforce.com or test.salesforce.com.
- Production
- Live consumer data. The consumer authorizes via OAuth with their own Salesforce login, and the org's instance URL is captured automatically during authorization. To test against a consumer's real configuration rather than sample data, ask them to connect a Salesforce sandbox copy of their org.
🚨Important to Know About Salesforce
- Starter Suite and the legacy Group and Essentials editions have no API access at all, so consumers on those editions cannot connect until they upgrade. Check your consumers' editions early.
- Since Spring '26 (March 2026) Salesforce blocks creation of new Connected Apps by default — new setups use an External Client App. Existing Connected Apps keep working, but migrating one reissues its Consumer Key and Secret, so the credentials stored in Apideck must be updated.
- The connecting user's profile decides what the API can see: Salesforce enforces sharing rules and field-level security, so connect with a user whose profile can see the records you need; a narrowly-scoped user returns partial data rather than an error.
- Refresh tokens never expire by default, but an org admin can apply an inactivity or fixed-duration refresh-token policy — when they do, affected consumers are dropped and have to authorize again.
- Virtual webhooks poll Salesforce on the consumer's behalf, so change detection draws on the same daily API quota as your reads. An org that exhausts the quota returns 403 REQUEST_LIMIT_EXCEEDED for both until usage falls back under the limit.
⚠️
17 gotchas across 11 resources
Connector-specific behaviors and limitations to be aware of
📦
11 supported resources
View field mappings, supported operations, and schema details