Choosing a Connection Method
Salesforce supports three ways to connect. Pick the one that matches your security requirements.Quick Connect (Recommended)
Quick Connect uses Scout’s managed OAuth app, so there’s nothing to configure in Salesforce.1
Open the Integrations page
Go to studio.scoutos.com/integrations and click the Salesforce card.
2
Connect with OAuth
Click Connect with OAuth and choose your environment — Production (login.salesforce.com) or Sandbox (test.salesforce.com).
3
Authorize in Salesforce
Sign in to Salesforce, review the requested permissions, and click Allow. You’ll be redirected back to Scout.
4
Verify the connection
Your workspace should show a green status indicator, the environment type, and the connection date.
Custom OAuth App
Use a custom Connected App when your security team requires Scout to authenticate through credentials you own and control.Prerequisites: Available across Group through Developer editions, in both Classic and Lightning. You need either
Customize Application + Modify All Data, or Customize Application + Manage Connected Apps.1
Enable connected app creation
In Salesforce, go to Setup → External Client App Settings and turn on the option to allow creation of connected apps. This is a one-time setting per org.
2
Create a Connected App
Click the gear icon → Setup → App Manager → New Connected App.
3
Configure basic information
Enter a connected app name, contact email, and (optionally) a logo URL, info URL, and description (256 characters max). The API name fills in automatically.
4
Enable OAuth settings
Turn on OAuth and configure:
- Callback URL:
https://studio.scoutos.com/oauth/salesforce/success - Scopes: Full access (
full), Access the identity URL service, Manage user data via APIs (api), Manage user data via Web browsers (web), and Perform requests at any time (refresh_token,offline_access) - Enable Client Credentials Flow and Authorization Code and Credentials Flow
- Require a secret for the Web Server Flow and Refresh Token Flow
5
Copy your credentials
Copy the Consumer Key (Client ID), then reveal and copy the Consumer Secret (Client Secret).
6
Connect to Scout
On the Salesforce card, click Add Workspace, check Use custom Salesforce Connected App credentials, select your environment, enter your Client ID and Client Secret, and click Connect with OAuth.
Salesforce can take a few minutes to activate a newly created Connected App. If authorization fails immediately after setup, wait a few minutes and try again.
JWT Bearer Flow (User-Scoped)
JWT Bearer Flow uses certificate-based authentication so Scout can act as a specific user without an interactive login. It’s ideal for scheduled and background jobs. Why use it:- No user interaction required — authentication happens automatically
- Access is scoped to a specific user
- Uses cryptographic signing instead of stored passwords
- Well suited to scheduled agents and server-to-server automation
1
Create a private key and certificate
Use OpenSSL to generate an RSA private key, a certificate signing request, and a self-signed certificate valid for 365 days:Keep
server.key secure — anyone with it can authenticate as the connected user.2
Create an External Client App with digital signatures
Go to App Manager → New External Client App and fill in the basics (set Distribution State to Local). Enable OAuth, set the callback URL to any HTTPS URL, and add the scopes
api and refresh_token, offline_access. Enable JWT Bearer Flow and upload your server.crt.3
Pre-authorize users
Open External Client App Manager → Policies → Edit. Set Permitted Users to “Admin approved users are pre-authorized” and IP Relaxation to “Relax IP restrictions”, then add the profiles or permission sets that should be allowed. Only pre-authorized users can authenticate.
4
Get the Consumer Key
Open the app, go to the OAuth Settings tab, and copy the Consumer Key.
5
Connect in Scout
On the Salesforce (User Scoped) card, click Add Workspace and complete the checklist. Paste your Consumer Key and the full PEM private key (including its headers), select your environment, and click Create Connection. Confirm the workspace shows a green status.
JWT Troubleshooting
JWT Security Best Practices
- Protect your private key and never commit it to source control
- Rotate certificates regularly (typically yearly)
- Grant the minimum permissions the agent needs
- Use separate apps for Production and Sandbox
- Monitor usage logs for unexpected activity
Verify the Connection
Open an agent, go to the Tools tab, and toggle Salesforce on. Then test with a prompt:- “List the last 5 accounts from Salesforce.”
- “Find the contact with email jane@example.com.”
- “Get opportunity by ID and summarize its stage and next steps.”
- “How many open opportunities do we have this quarter?”
The authorizing user’s Salesforce permissions apply. If a user can’t read a field or object in Salesforce, the agent can’t either. Check field-level security in Salesforce Setup if the agent returns incomplete records.
Available Capabilities
Once connected and enabled, your agent can:Instruction Guardrails
CRM writes are consequential. A bad update can corrupt a record, create a duplicate, or overwrite data another rep entered. Add this block to your agent’s Instructions before enabling any write tools:Troubleshooting
Next Steps
HubSpot
Connect HubSpot too — agents can use Salesforce and HubSpot tools in the same workflow.
Slack
Route pipeline summaries and deal alerts from Salesforce to team channels.
Gmail
Add email context to Salesforce-driven outreach workflows.
Integrations Overview
See the full integration stack and recommended connection order.