# Salesforce authentication

> Connect UiPath to Salesforce using your preferred authentication method.

## Supported editions

To authenticate on Salesforce, you must have an edition that includes API support. The Salesforce connector works with the following edition (not limited to):

* Salesforce Sales Cloud (Enterprise or Professional with API support)

For all other editions not listed, contact your UiPath representative for assistance.

:::note
The connector uses the Salesforce REST API. Confirm that your Salesforce edition includes API access before proceeding.
:::

## Prerequisites

To create a connection, you need the following credentials:

* OAuth 2.0 Authorization code: username, password.
* OAuth 2.0 Password: username, password, security token.
* Bring your own OAuth 2.0 app: Client ID, Client secret.
* Personal Access Token (PAT): OAuth API Key, OAuth API Secret, JWT base64 encoded key, Audience, Issuer, Subject.
* OAuth 2.0 Client Credentials: Domain, OAuth API Key, OAuth API Secret.

Additionally, you may need an authenticator application installed on your mobile phone if your Salesforce organization enforces multi-factor authentication (MFA).

Before creating a connection, also ensure the following:

1. You have a Salesforce Sales Cloud Enterprise edition, Professional edition with API support, or another supported edition listed above.
2. You have Administrator privileges in Salesforce Sales Cloud to set up applications. Contact your system administrator if you do not have these privileges.
3. The API Enabled permission is activated for your Salesforce user profile. To verify: open Salesforce and go to Setup > Administration > Users > Profiles, select the relevant profile, and confirm that API Enabled is checked.

:::tip
* **How to check your assigned profile:** Click your profile avatar in the top-right corner of Salesforce, then click **Settings > Advanced User Details**. Your profile name is listed in the **Profile** field. Alternatively, go to **Setup > Administration > Users > Users** and check the Profile column for your username.
* We recommend provisioning and assigning a dedicated Salesforce integration user for UiPath connections. Connections inherit the permissions of the account used for authentication, including access to fields and objects. Using a dedicated user ensures consistent, auditable access.
:::

## Authentication methods

The UiPath Salesforce connector supports the following authentication methods. The credentials required depend on the method you choose:

| Auth method | Description | Required credentials |
|---|---|---|
| **OAuth 2.0 Authorization Code** | Redirects to Salesforce for login and consent. | Salesforce username and password |
| **OAuth 2.0 Password** *(deprecated)* | Legacy authentication for older Salesforce accounts/apps. Blocked by default for new orgs as per [Salesforce release notes](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_username-password_flow_blocked_by_default.htm&release=244&type=5), and scheduled for retirement with Salesforce Winter '27 (September–October 2026). We recommend using one of the other OAuth methods instead. Only use for special scenarios. | Username, password, security token |
| **Personal Access Token (PAT)** | JSON Web Token (JWT) bearer server-to-server authentication using a digital certificate. Ideal for unattended automations where no interactive login is possible. | Environment, OAuth API Key, OAuth API Secret, JWT base64 encoded key, Audience, Issuer (`client_id`), Subject (username) |
| **Bring Your Own App (BYOA)** | Uses a private application you create in Salesforce. Recommended by UiPath since it gives you full control over scopes, policies, and branding. | Client ID, Client Secret (from your Salesforce External Client App) |
| **OAuth 2.0 Client Credentials** | Server-to-server flow requiring no user interaction. Suitable for unattended automations using a dedicated system user. | Domain (Salesforce org URL), OAuth API Key (Consumer Key), OAuth API Secret (Consumer Secret) |

:::note
When registering your OAuth application in Salesforce, make sure to set the [callback URL](connections#callback-url) to the value displayed on the connection creation page, for example `https://cloud.uipath.com/provisioning_/callback` for Automation Cloud.
:::

To learn more about the different types of authentication available for Salesforce, refer to the official Salesforce documentation in [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5).

### OAuth 2.0 Authorization code

This method uses the public UiPath connected application and redirects you to Salesforce for authentication. Follow these steps:

1. Select Orchestrator from the UiPath product launcher.
2. Select a folder, then navigate to the **Connections** tab.
3. Select **Add connection**.
4. Search for and select the **Salesforce** connector from the list.
5. Select the environment: **Production** or **Sandbox**.
6. Select **OAuth 2.0 Authorization Code** as the authentication method.
7. Select **Connect**. You will be redirected to the Salesforce login page.
8. Enter your Salesforce username and password.
9. If prompted by MFA, enter the verification code from your authenticator app.
10. Review the permissions requested by UiPath and select **Allow**.
11. You are redirected back to Orchestrator. The connection status should show as **Connected**.

**Custom domain:** If your Salesforce organization uses a custom domain, click **Use Custom Domain** on the Salesforce login screen, enter your custom domain URL (e.g., yourcompany.my.salesforce.com), then click Continue and enter your credentials.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/integration-service/integration-service-docs-image-449338-e573bf49.webp)

:::note
This method uses the public UiPath Connected App. If you encounter an `OAUTH_APPROVAL_ERROR_GENERIC` error, see the [Troubleshooting](#troubleshooting) section.
:::

### OAuth 2.0 Password (deprecated)

:::warning
This authentication method is deprecated. Salesforce has deprecated the OAuth 2.0 Username-Password flow for connected apps and is retiring it with the Winter '27 release (rolling out September–October 2026, enforced per org). See the [Salesforce Release Update](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5). It is also blocked by default for new Salesforce organizations.

We recommend migrating to one of the other available OAuth methods — OAuth 2.0 Authorization Code, OAuth 2.0 Client Credentials, JWT Bearer (PAT), or Bring Your Own App (BYOA). Only use OAuth 2.0 Password if your organization explicitly requires it for backward compatibility.
:::

If you need to use this method, first enable it by following the Salesforce documentation: [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_username_password_flow.htm&type=5). Then:

1. Follow steps 1–5 from the OAuth 2.0 Authorization Code instructions above.
2. Select **OAuth 2.0 Password** as the authentication method.
3. Enter your Salesforce username, password, and security token.

   Where available, select the menu next to a field and choose **Use credential asset** or **Use Orchestrator asset** to reference an Orchestrator asset instead of entering the value directly. For more information, see [Use credential assets for connections](credential-store-connections.md).
4. Select **Connect**.

**Obtaining your security token:** In Salesforce, go to your profile settings > Reset My Security Token. The token is sent to your email. Append it to your password when connecting.

### JWT Bearer authentication (PAT)

JWT bearer authentication uses a digital certificate to sign a JWT request, enabling server-to-server integration without interactive login. This is ideal for unattended automations. Follow these steps:

1. **Create a private key and self-signed digital certificate.** Refer to the Salesforce guide: [Create a Private Key and Self-Signed Digital Certificate](https://help.salesforce.com/s/articleView?id=sf.connected_app_create_cert_key.htm&type=5).
2. **Create an External Client App in Salesforce.** Go to Setup > Apps > External Client Apps > External Client App Manager and select **New External Client App**. Upload your digital certificate in the app configuration. (See the [BYOA / External Client App Setup](#bring-your-own-app-byoa-recommended) section below for detailed steps.)
3. **Configure the JWT Bearer flow.** In the External Client App settings, enable the JWT Bearer flow under Flow Enablement. Assign the required OAuth scopes.
4. **Pre-authorize the app for your integration user.** Go to Setup > Connected Apps > Manage Connected Apps, find your app, and under Policies, set Permitted Users to "Admin approved users are pre-authorized." Then add the relevant profile or permission set.
5. **Retrieve the Consumer Key and Consumer Secret** of your External Client App, as described in [Step B: Retrieve the Client ID and Client Secret](#step-b-retrieve-the-client-id-and-client-secret). You need both for the **OAuth API Key** and **OAuth API Secret** fields.
6. In UiPath Orchestrator, select Orchestrator > folder > Connections > Add connection > Salesforce.
7. Under **Folder in which connection is stored**, confirm or change the folder where the connection is saved (for example, **My Workspace**).
8. For **Authentication Type**, select **Personal Access Token (PAT)**.
9. Complete the connection fields. All fields marked with an asterisk (\*) are required.

   | Field | Required | Description |
   |---|---|---|
   | **Environment** | Yes | Select **Sandbox** for testing environments or **Production** for live operations. |
   | **OAuth API Key** | Yes | Enter the API Key found in the *App Credentials* section of your application — the Consumer Key of your External Client App. |
   | **OAuth API Secret** | Yes | Enter the API Secret found in the *App Credentials* section of your application — the Consumer Secret of your External Client App. |
   | **JWT base64 encoded key** | Yes | Paste your Base64-encoded JWT private key — the private key you generated in step 1, encoded in Base64. |
   | **Audience** | Yes | Enter the audience value (`aud`) that identifies the target authorization server: `https://login.salesforce.com` for Production or `https://test.salesforce.com` for Sandbox. |
   | **Issuer** | Yes | Enter the OAuth `client_id` (`iss`) from your External Client App — the Consumer Key, same value as **OAuth API Key**. |
   | **Subject** | Yes | Enter the username (`sub`) of the account being authorized or impersonated. This user must be pre-authorized for the app (step 4). |

   Where available, select the menu next to a field and choose **Use credential asset** or **Use Orchestrator asset** to reference an Orchestrator asset instead of entering the value directly. For more information, see [Use credential assets for connections](credential-store-connections.md).
10. Optionally, expand **Advanced settings** to review or change the **Connection Type**. The default is **Standard**, which uses the public connector APIs. For connections to Salesforce instances that are not exposed to the public internet, see [Connecting to on-premises systems](connections#connecting-to-on-premises-systems).
11. Select **Connect**.

For more details on enabling JWT Tokens, refer to the Salesforce documentation: [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5), [Enable JSON Web Token (JWT)-Based Access Tokens](https://help.salesforce.com/s/articleView?id=sf.connected_app_enable_jwt.htm&type=5), and [JWT-Based Access Tokens](https://help.salesforce.com/s/articleView?id=sf.jwt_access_tokens.htm&type=5).

### Bring your own app (BYOA) (recommended)

:::important
Salesforce has deprecated the legacy Connected App model. All new applications must be created as External Client Apps. Existing Connected Apps continue to function, but Salesforce recommends migrating to External Client Apps. The steps below reflect the new External Client App workflow.
:::

This method uses a private application that you create and manage in Salesforce, giving you full control over OAuth scopes and security policies. Follow these steps:

#### Step A: Create an External Client App in Salesforce

1. Sign in to your Salesforce account and go to Setup.
2. Navigate to **Apps > External Client Apps > External Client App Manager**.
3. Select **New External Client App**.
4. Fill in the required fields:
   * **External Client App Name:** A descriptive name (e.g., "UiPath Integration").
   * **API Name:** Must contain only underscores and alphanumeric characters, be unique, start with a letter, and not end with an underscore or contain consecutive underscores.
   * **Contact Email:** The email address for the app owner.
   * **Distribution State:** Select Local (for single-org use) or Packaged.
5. Expand the **API (Enable OAuth Settings)** section and check **Enable OAuth**.
6. In the **Callback URL** field, enter the UiPath OAuth callback URL provided in your Orchestrator connection setup screen.
7. Select the required OAuth Scopes and move them to Selected OAuth Scopes. At minimum, include: Access the identity URL service, Manage user data via APIs, and Perform requests at any time.
8. Under **Flow Enablement**, select **Enable Authorization Code and Credentials Flow**.
9. Under **Security**, check both **Require secret for Web Server Flow** and **Require secret for Refresh Token Flow**.
10. Select **Create**.

#### Step A.1: Configure policies (required)

After creating the External Client App, you must configure its policies:

1. Go to **Setup > Connected Apps > Manage Connected Apps**.
2. Find your External Client App and select **Edit Policies**.
3. Set the following:
   * **Permitted Users:** "All users may self-authorize"
   * **IP Relaxation:** "Relax IP restrictions"
   * **Refresh Token Policy:** "Refresh token is valid until revoked"
4. Select **Save**.

#### Step B: Retrieve the Client ID and Client Secret

1. In the External Client App, go to the **Settings** tab.
2. Expand **OAuth Settings**.
3. Select **Consumer Key and Secret**.
4. Enter your credentials (and OTP if prompted).
5. Copy the **Consumer Key** (this is your Client ID) and **Consumer Secret** (this is your Client Secret). Store these securely.

:::note
After creating or modifying an External Client App, Salesforce can take **up to 10 minutes** to propagate the changes. Wait before attempting to connect.
:::

#### Step C: Connect in UiPath Orchestrator

1. In Orchestrator, go to your folder > Connections > **Add connection** > Salesforce.
2. Select the environment (**Production** or **Sandbox**).
3. Select **Bring Your Own OAuth 2.0 App** as the authentication method.
4. Enter the **Client ID** and **Client Secret** from Step B.

   Where available, select the menu next to a field and choose **Use credential asset** or **Use Orchestrator asset** to reference an Orchestrator asset instead of entering the value directly. For more information, see [Use credential assets for connections](credential-store-connections.md).
5. Select **Connect**.
6. Complete the Salesforce login and authorize the app.

For more details, refer to the Salesforce documentation: [Configure the External Client App OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.ec_app_add_oauth_settings.htm&type=5) and [Enable OAuth Settings for API Integration](https://help.salesforce.com/s/articleView?language=en_US&id=sf.connected_app_create_api_integration.htm&type=5).

### OAuth 2.0 Client Credentials

The OAuth 2.0 Client Credentials flow is a server-to-server authentication method that does not require user interaction. It is suitable for unattended automations where the connection acts on behalf of a dedicated system user rather than an individual.

**Prerequisites in Salesforce:**

Your Salesforce External Client App must have the client credentials flow enabled. If you have not yet created an External Client App, follow [Step A](#bring-your-own-app-byoa-recommended) first.

1. In Salesforce Setup, go to **Apps > External Client Apps > External Client App Manager**.
2. Open your External Client App and go to **Flow Enablement**.
3. Enable **OAuth 2.0 Client Credentials Flow**.
4. Set a **Run As** user — this is the Salesforce user account the connection acts as when making API calls.
5. Retrieve the **Consumer Key** and **Consumer Secret** from **Settings > OAuth Settings > Consumer Key and Secret**.

:::note
The Run As user must have the API Enabled permission and the appropriate object and field access for your automations. See [Permissions](#permissions).
:::

**Connect in UiPath Orchestrator:**

1. In Orchestrator, go to your folder > Connections > **Add connection** > Salesforce.
2. Select the environment (**Production** or **Sandbox**).
3. Select **OAuth 2.0 Client Credentials** as the authentication method.
4. Enter the following credentials:
   - **Domain**: Your Salesforce org URL (for example, `https://myorg.my.salesforce.com`).
   - **OAuth API Key**: The Consumer Key from your External Client App.
   - **OAuth API Secret**: The Consumer Secret from your External Client App.
5. Select **Connect**.

## Token expiration and refresh

OAuth tokens may expire after a set amount of time depending on your Salesforce configuration. To prevent unexpected disconnections in production workflows:

* **Set the Refresh Token Policy to "Refresh token is valid until revoked"** in your Salesforce Connected App or External Client App settings.
* **Ensure the "Perform requests at any time" scope is granted.** This scope enables offline refresh and is not included in the "full access" scope — it must be configured independently.

Refer to the Salesforce guides: [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=sf.connected_app_manage_oauth.htm&type=5) and [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_tokens_scopes.htm&type=5) for detailed configuration steps.

## Sandbox setup

For setting up a Sandbox account, follow the steps described in the Salesforce official documentation: [Sandbox Setup Considerations](https://help.salesforce.com/s/articleView?id=sf.data_sandbox_implementation_tips.htm&type=5).

Salesforce sandboxes are isolated from your production organization. Operations performed in a sandbox do not affect production data, and vice versa. Sandboxes are nearly identical to production, but some differences exist — refer to the Salesforce documentation for details.

:::tip
When first starting to use UiPath with Salesforce, we recommend testing on a sandbox account or with non-essential data. This prevents any loss of crucial data, especially since actions performed through automations may not be easily undone.
:::

## Permissions

Salesforce connections in UiPath inherit the permissions of the account used for authentication. Below is a comprehensive guide to the permissions required.

### Required OAuth scopes (public UiPath app)

When creating a connection through the public UiPath application, the connector requests the following permissions:

| Permission / Scope | Purpose |
|---|---|
| Access the identity URL service | Retrieve user identity information |
| Manage user data via APIs | Read and write Salesforce records via API |
| Manage user data via Web browsers | Browser-based data access |
| Access Connect REST API resources | Chatter and Connect API access |
| Access Visualforce applications | Interact with Visualforce pages |
| Access unique user identifiers | Unique user ID access for mapping |
| Access custom permissions | Read custom permission assignments |
| Access Analytics REST API resources | Reports and dashboards via API |
| Access Analytics REST API Charts Geodata resources | Geo-data in analytics |
| Manage hub connections | Hub connection management |
| Manage Pardot services | Pardot marketing automation access |
| Access Lightning applications | Lightning Experience access |
| Access content resources | Content library access |
| Manage Salesforce CDP Ingestion API data | CDP data ingestion |
| Manage Salesforce CDP profile data | CDP profile management |
| Perform ANSI SQL queries on Salesforce CDP data | CDP data querying |
| Access chatbot services | Einstein Bot services |
| Perform requests at any time | Offline refresh token access |
| Perform segmentation on Salesforce CDP data | CDP segmentation |

### API enabled permission

You must have the **API Enabled** permission in Salesforce. To configure: go to **Setup > Administration > Users > Profiles**, select the relevant profile, and ensure API Enabled is checked under Administrative Permissions.

### Standard and custom object permissions

We recommend that the connected user's account has permissions to read, write, edit, delete, view all, and modify all for the standard or custom objects your automations interact with. To configure:

* Go to **Setup > Administration > Users > Profiles** (or **Permission Sets**).
* Locate the relevant standard or custom objects and assign the required permissions.
* Object-level security is the broadest way to control data access. It configures a user's ability to view, create, edit, or delete records of a specific object type (e.g., Leads, Opportunities). If an object is hidden from the integration user, it will not appear in UiPath.

:::note
If expected Salesforce objects are not appearing in UiPath, check with your Salesforce admin to confirm that the integration user has access to all required objects.
:::

### Field-level security

Field-level security controls the visibility of individual fields within objects, including in related lists, list views, reports, and search results. It also determines whether users can view or edit field values. This allows you to protect sensitive data without hiding entire objects.

Configure field-level security via profiles or permission sets in Salesforce. If expected fields are not appearing in UiPath, check with your Salesforce admin to confirm the integration user has access to the required fields.

### Profiles and permission sets

User permissions and access settings control what users can do in your Salesforce organization:

* **Profiles:** Define the baseline permissions for a group of users. Each user is assigned one profile. Use profiles to assign the minimum required permissions.
* **Permission Sets:** Add additional permissions on top of a profile. A user can have multiple permission sets. Use these to layer extra access as needed for integrations.

## Troubleshooting

  
    
      Error / Symptom
      Resolution
    
  
  
    
      OAUTH_APPROVAL_ERROR_GENERIC
      
        Salesforce is blocking the UiPath app because it is not installed. This applies to the public UiPath Connected App only (not BYOA External Client Apps, which are secure-by-default and exempt from this restriction). To resolve:
        
          Install the app: A Salesforce administrator must go to Setup > Connected Apps OAuth Usage, locate the UiPath connector, and click Install. Once installed, configure the OAuth policies as needed.
          Assign bypass permissions: A Salesforce admin can assign Approve Uninstalled Connected Apps (available when API Access Control is not enabled) or Use Any API Client (works when API Access Control is enabled).
        
      
    
    
      invalid_client_id / "client identifier invalid"
      
        The Consumer Key (Client ID) is not recognized. Common causes:
        
          Propagation delay — after creating or modifying an External Client App, wait up to 10 minutes for Salesforce to propagate changes.
          Wrong Consumer Key — re-copy it from your External Client App Settings tab > OAuth Settings > Consumer Key and Secret.
          Sandbox/production mismatch — ensure the environment selected in UiPath matches where the app was created (Sandbox uses <code>test.salesforce.com</code>, Production uses <code>login.salesforce.com</code>).
        
      
    
    
      missing required code challenge
      
        PKCE (Proof Key for Code Exchange) is enforced. Disable it in two places:
        
          Org level: Setup &gt; Identity &gt; OAuth and OpenID Connect Settings — toggle off "Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows."
          App level: In the External Client App's OAuth settings, uncheck the PKCE requirement.
        
        The org-level setting overrides the app-level setting — both must be off. After disabling, wait a few minutes and clear your browser cache before retrying.
      
    
    
      Failed to exchange OAuth code for token
      
        The authorization code was issued but the token exchange failed. Common causes for External Client Apps:
        
          Callback URL mismatch — verify the URL in your External Client App exactly matches what UiPath sends (check <code>http</code> vs <code>https</code>, trailing slashes, case).
          Incorrect Client Secret — re-copy from Settings &gt; OAuth Settings &gt; Consumer Key and Secret.
          Policies not configured — go to Setup &gt; Connected Apps &gt; Manage Connected Apps, find the app, click Edit Policies, and set Permitted Users to "All users may self-authorize," IP Relaxation to "Relax IP restrictions," and Refresh Token Policy to "Refresh token is valid until revoked."
          Token limit — Salesforce allows max 5 concurrent tokens per user per app; revoke old tokens via Setup &gt; Security &gt; Session Management.
        
      
    
    
      Connection disconnects unexpectedly
      The refresh token may have expired. Set the Refresh Token Policy to "Refresh token is valid until revoked" and ensure the "Perform requests at any time" scope is granted. See the Token expiration and refresh section.
    
    
      Objects or fields missing in UiPath
      Object-level or field-level security settings are preventing visibility. Check with your Salesforce admin to confirm the integration user's profile has read/write access to the required objects and fields.
    
    
      API Enabled error / insufficient privileges
      The connected user's profile does not have the API Enabled permission. Go to Setup &gt; Profiles, select the profile, and enable it under Administrative Permissions.
    
    
      MFA prompt during connection
      Your org requires multi-factor authentication. Use an authenticator app to complete the verification step. For automated (unattended) scenarios, consider using JWT bearer authentication which does not require interactive MFA.
    
    
      Custom domain not recognized
      Click "Use Custom Domain" on the Salesforce login screen, enter the full custom domain URL (e.g., yourcompany.my.salesforce.com), and click Continue before entering credentials.
    
  

## Best practices

* **Use a dedicated integration user.** Create a dedicated Salesforce user for UiPath integrations rather than using personal accounts. This ensures consistent permissions, simplifies auditing, and avoids disruption when individual users change roles.
* **Test in a sandbox first.** Always test new connections and automations in a Salesforce sandbox environment before deploying to production. Actions performed through UiPath cannot always be undone.
* **Apply least-privilege permissions.** Grant only the object and field access your automations actually need. Use profiles for baseline access and permission sets for additional scopes.
* **Configure token refresh policies.** Set the refresh token policy to "valid until revoked" and grant the "Perform requests at any time" scope to avoid unexpected disconnections.
* **Use meaningful connection names.** When creating connections in Orchestrator, use descriptive names that indicate the environment and purpose (e.g., "Salesforce-Production-OrderSync") to make management easier.
* **Plan for Salesforce's External Client App migration.** Salesforce has deprecated the legacy Connected App model. All new apps should be created as External Client Apps. Plan to migrate existing Connected Apps per Salesforce's guidance.