Connecting Salesforce

You can connect one CRM per account. Salesforce connects with an External Client App: create an External Client App (Setup -> External Client App Manager), turn on the Client Credentials Flow with a Run As user and the api scope, then paste your Instance URL, Consumer Key and Consumer Secret. Then click Save & test.

Salesforce specifics

Salesforce no longer lets you create new Connected Apps (switched off in every org from the Spring '26 release). Use an External Client App instead. A Connected App you already have still works the same way. Most failures are app setup, and often show as a generic "Connection test failed":

• Create it in Setup -> External Client App Manager -> New External Client App, with Distribution State Local, OAuth enabled and the Manage user data via APIs (api) scope. The callback URL is required but never used - https://login.salesforce.com/services/oauth2/callback is fine.
• Client Credentials Flow must be switched on in two places: on the app's settings (OAuth Settings) and on its Policies tab, where you also set Run As to a user who can see the records you want reported. Missing the second one gives "no client credentials user enabled". Run As takes the Salesforce username, which is not always the same as your email address.
• On the Policies tab, set Start Page to Default (otherwise it asks for an OAuth Start URL) and IP Relaxation to relax IP restrictions.
• The Consumer Key and Secret are on the app's Settings tab under OAuth Settings.
• Use your My Domain API URL (https://yourorg.my.salesforce.com) as the Instance URL - not the Lightning/Setup URL (*.lightning.force.com).
• Sandbox vs production: a sandbox org's URL differs from production - use the right one for the org your token is from.
• A new or changed app can take a few minutes to take effect - wait five minutes and test again before changing anything else.

For errors every CRM shares, and what a connected CRM powers, see Connecting your CRM.