Salesforce

Description

Used for importing data from a Salesforce service.

Task Type Support

This connection type supports the following task types:

  • Data Migration

Data Migration Support

This connection can be used in a Data Migration.

Usable as Source Usable as Target Usable as Incremental Source Usable as Incremental Target
✔ ❌ ❌ ❌

Connection String Templates

Template Name Description
Salesforce Standard User, Password and the Security Token. If using a security token, add AuthScheme=Basic;.

Please note that support for other OAuth flows will come in a future Loome update. The following guide currently covers the Client Credentials flow.

Connection Notes

  • The security token is from Salesforce
    • If using a security token parameter, you will need to add AuthScheme=Basic; to the connection string.
  • Users can use OAuth authentication

Learn How to Set Up a Salesforce Client Credentials Flow for Loome Integrate

This guide covers setting up an External Client App in Salesforce for the OAuth 2.0 Client Credentials flow, and configuring Loome Integrate to use it.

Note that this guide currently covers the Client Credentials flow only. Support for other OAuth flows will come in a future Loome update.

Prerequisites

  • A Salesforce org with a My Domain already registered and deployed (Setup → My Domain). Note your domain, e.g. https://yourdomain.my.salesforce.com — you’ll need it for the connection string.
  • Permission to create External Client Apps in the org.

Connected App creation is restricted as of Spring ‘26. Salesforce now recommends External Client Apps for new OAuth integrations, including Client Credentials Flow.

Part 1: Create the External Client App

  1. In Setup, search App Manager in Quick Find.
    • Click New External Client App.
  2. Fill in Label, Contact Email (required). Leave Distribution State as Local unless you need to package/distribute the app.
  3. Under API (Enable OAuth Settings), check Enable OAuth.
  4. Set a Callback URL. This flow doesn’t use it, but the field is required — any placeholder works (e.g. https://login.salesforce.com).
  5. Under OAuth Scopes, add at minimum Manage user data via APIs (api).
  6. Under Flow Enablement, check Enable Client Credentials Flow.
    • Confirm the popup if one appears.
  7. Click Create.

Part 2: Configure OAuth Policies

External Client Apps take effect immediately (no multi-minute provisioning delay like legacy Connected Apps).

  1. Go to Setup → Apps → External Client Apps → External Client App Manager, open your app.
  2. Go to the Policies tab → Edit.
  3. Under OAuth Policies, tick Enable Client Credentials Flow again here (it must be enabled at both the app-settings level and the policy level — the policy-level checkbox will stay greyed out until Flow Enablement is set on the app itself, per Part 1 step 6).
  4. Set Run As (Username) to the user whose permissions the integration should run as. For visibility of all Salesforce objects/fields (matching what you’d get with an admin login under Basic auth), use an admin or admin-equivalent user.
  5. Save.

Part 3: Get the Consumer Key and Secret

  1. From the app’s Settings tab, expand OAuth Settings
    • Click Consumer Key and Secret.
  2. Verify your identity via the emailed code.
  3. Copy the Consumer Key and Consumer Secret
    • These map to OAuthClientId and OAuthClientSecret.

Part 4: Loome Integrate Connection

Create or Update the Connection

  1. In Loome Integrate, click the top-right tenant dropdown and then click on Connections.
  2. Either:
    • New connection: click Add Connection at the top-right of the page.
    • Existing connection: click on Edit on the connection you want to update.
  3. Wizard page 1:
    • New connection: enter a name in Connection Name, then search for salesforce in the connector search box (or scroll to find it) and select the Salesforce connector. Click Next.
    • Existing connection: click Next.
  4. Wizard page 2: paste the connection string below into the Connection String field.
  5. Select an agent from the Validate with Agent dropdown and click Submit.
  6. You’ll be returned to the Connections page. A green toast notification will confirm if it was successful; a red toast notification will show an error message if it failed.

Connection String

Following is the connection string template for the connection string field.

Replace the values with your own in the connection string field.

On agent version 2026.9.4.1 or later, you do not need to provide your Client Id and Secret in the connection string and can instead provide it in the Username and Password fields, so that it is stored separately from the connection string and only injected at runtime. Find the following connection string template with these fields omitted.

Read the connection string key points below to provide values with the correct requirements.

AuthScheme=OAuthClient;
Url=https://yourdomain.my.salesforce.com;
OAuthServerUrl=https://yourdomain.my.salesforce.com;
LoginURL=https://yourdomain.my.salesforce.com;
OAuthClientId=<Consumer Key>;
OAuthClientSecret=<Consumer Secret>;
InitiateOAuth=GETANDREFRESH;
Existing Connection with Basic Authentication

If you’re updating an existing connection that previously used Basic auth (username/password), either: - Replace the Username/Password fields with the Consumer Key/Consumer Secret, or - Blank out the Username/Password fields if you’re putting OAuthClientId/OAuthClientSecret directly in the connection string instead.

Existing Connection with Basic Authentication Separate from the Connection String

On agent version 2026.9.4.1 or later, you can keep credentials out of the connection string: put the Consumer Key in the Username field and the Consumer Secret in the Password field instead, and omit OAuthClientId/OAuthClientSecret from the connection string entirely. Username/Password are stored separately from the connection string and only injected at runtime.

AuthScheme=OAuthClient;
Url=https://yourdomain.my.salesforce.com;
OAuthServerUrl=https://yourdomain.my.salesforce.com;
LoginURL=https://yourdomain.my.salesforce.com;
InitiateOAuth=GETANDREFRESH;
Connection String Key Points:
  • Url must be your My Domain URL, not login.salesforce.com or test.salesforce.com — Salesforce explicitly rejects Client Credentials Flow requests to those generic domains (invalid_grant: request not supported on this domain).
  • OAuthServerUrl should also be set to the My Domain URL.
  • LoginURL must also be set to the My Domain URL — without it, the driver defaults to login.salesforce.com for the token request regardless of the other URL properties.
  • No User/Password/SecurityToken needed in the connection string itself — identity comes entirely from the Run As user configured on the app.
  • InitiateOAuth=GETANDREFRESH lets the driver manage token acquisition automatically.

Verifying Salesforce-Side Config Independently

If Loome Integrate fails to connect, it’s useful to confirm the Salesforce side is correct independent of the driver, via a raw request:

curl.exe -X POST https://yourdomain.my.salesforce.com/services/oauth2/token `
  -d "grant_type=client_credentials" `
  -d "client_id=<Consumer Key>" `
  -d "client_secret=<Consumer Secret>"

A successful response returns a JSON object containing access_token. If this succeeds but Loome Integrate still fails, the issue is in the driver, not the Salesforce configuration.

Note that this guide currently covers the Client Credentials flow only. Support for other OAuth flows will come in a future Loome update.