31  Connect Salesforce

Connect Salesforce to Claude Tag so it can read and update CRM records. Covers the connected app to create, the client credential fields, and the host to allow.

export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.;

Connections are added inside an Access bundle. At claude.ai/admin-settings/claude-tag, open Access bundles in the left navigation, click into a bundle (or Create one), and go to its Credentials tab.

Connecting Salesforce lets Claude read accounts, contacts, opportunities, and cases (and write, if you grant it) from any channel under the bundle’s scope. You add it as a connection inside an Access bundle; the credential belongs to the agent, not to any person. The connection uses the OAuth 2.0 client credentials flow.

31.1 Create the credential in Salesforce

Create a connected app (or External Client App) with the client credentials flow enabled, and set a dedicated integration user as the app’s run-as user. Salesforce’s guide is Configure a Connected App for the OAuth 2.0 Client Credentials Flow.

You’ll need from Salesforce:

  • The app’s Consumer Key (the client ID), from its Settings tab
  • The app’s Consumer Secret (the client secret)
  • Your org’s My Domain host (for example yourcompany.my.salesforce.com)

Assign the integration user a Permission Set scoped to the objects and fields Claude should reach. Read-only is the recommended starting point.

31.2 Add the connection to a bundle

In the bundle, click Connect next to Salesforce.

Field Value
Client ID The app’s Consumer Key
Client secret The app’s Consumer Secret
Token URL Your org’s token endpoint, https://yourcompany.my.salesforce.com/services/oauth2/token
Scopes (optional) Leave empty unless your app requires specific scopes
Allowed websites Your org’s host, for example yourcompany.my.salesforce.com

The preset prefills Allowed websites with an example host that cannot resolve. Replace it with your org’s host before saving, or every request fails. To change the host later, open the ⋮ menu on this connection in the bundle’s Credentials tab and choose Edit.

The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See how Agent Proxy works.

31.3 Verify the connection

In a channel under the bundle’s scope, in a new thread:

text wrap theme={null} @Claude list the five most recently modified Opportunities in Salesforce.

Check the integration user’s login history in Salesforce Setup to confirm the call landed under that user.