Salesforce

Use Salesforce System Administrator credentials for an API-enabled production or sandbox org where Hosted MCP Servers are available. Salesforce documents availability for Enterprise Edition and above. You need authority to create an External Client App and enable Hosted MCP Servers.

Sign in to the Salesforce org that will expose its records. Create the credentials in that same org. This guide does not cover scratch orgs.

Open Salesforce Setup

1. At the top of any Salesforce page, select the setup gear icon.
2. Select Setup.

For a lower-edition org:

1. In Quick Find, enter MCP Servers.
2. Select MCP Servers under API Catalog.
3. Confirm that Hosted MCP Servers are available in the target org before continuing.

Start an External Client App

1. In Quick Find, enter external client.
2. Select External Client App Manager.
3. Select New External Client App.
4. Under Basic Information, enter a descriptive App Name, such as Speakeasy MCP.
5. Accept the generated API Name.
6. Enter the responsible administrator’s or application owner’s email address in Contact Email.
7. Set Distribution State to Local.

Configure OAuth settings

1. Expand API (Enable OAuth Settings).
2. Select Enable OAuth.
3. Enter https://app.getgram.ai/mcp/remote_login_callback in Callback URL.
4. In Available OAuth Scopes, select Access MCP servers (mcp_api).
5. Select the right-arrow control to move it to Selected OAuth Scopes.
6. In Available OAuth Scopes, select Perform requests at any time (refresh_token).
7. Select the right-arrow control to move it to Selected OAuth Scopes.
8. Under Security, select Issue JSON Web Token (JWT)-based access tokens for named users.
9. Leave Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows deselected.
10. Leave Require Secret for Web Server Flow deselected.
11. Leave Require Secret for Refresh Token Flow deselected.
12. Leave all other Security options that can be changed without Salesforce support deselected.

Create the External Client App

Select Create.

The app can take up to 30 minutes to become operational. If attaching it immediately fails even though the settings are correct, wait for that window before changing the configuration.

Copy the Consumer Key

1. On the saved External Client App, select Settings.
2. Under OAuth Settings, select Consumer Key and Secret.
3. Complete the Salesforce verification prompt if it appears.
4. Copy Consumer Key. You will use it as the Speakeasy Client ID.

Enable the selected SObject server

Choose the least-privileged server that meets the team’s needs:

• sobject-reads allows discovery, query, search, and relationship traversal without changing records.
• sobject-mutations allows reading, creating, and updating records without deleting them.
• sobject-deletes allows identifying and deleting records without creating or updating them.
• sobject-all allows creating, reading, updating, deleting, querying, and searching records.

If the ticket does not specify the team’s approved read, write, or delete requirements, obtain the server choice from the application or cloud security owner.

1. Return to Setup.
2. In Quick Find, enter MCP Servers.
3. Select MCP Servers under API Catalog.
4. Find the server whose API ID matches the approved choice.
5. Use the available control to enable that server.
6. Record its URL from the table below, using the production or sandbox form that matches the org.
7. Wait up to two minutes for the server to become active.

Server	Production URL	Sandbox URL
sobject-reads	https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads	https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-reads
sobject-mutations	https://api.salesforce.com/platform/mcp/v1/platform/sobject-mutations	https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-mutations
sobject-deletes	https://api.salesforce.com/platform/mcp/v1/platform/sobject-deletes	https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-deletes
sobject-all	https://api.salesforce.com/platform/mcp/v1/platform/sobject-all	https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all

If the connection fails with valid credentials, confirm that the selected server is enabled, the URL matches the server and org type, and the org has API access.

Add the server in Speakeasy

1. In the Speakeasy AI Control Plane sidebar, under Connect, select Sources.
2. Select Add Source.
3. Choose Custom remote server.
4. On the Add a custom remote MCP server page, paste the URL recorded in Enable the selected SObject server into Remote MCP server URL.
5. Select Add server.

This creates the hosted MCP Server and opens its Overview page.

Connect your credentials

1. From the server’s Overview, open Settings.
2. Under Authentication, select Configure Manually.
3. In Attach Remote Identity Provider, set Client Type to Manual.
4. Confirm that Redirect URI matches the https://app.getgram.ai/mcp/remote_login_callback registered in Configure OAuth settings.

The Consumer Key-only mapping below is an unverified candidate configuration. Salesforce documents it for compatible public clients but not for the Speakeasy AI Control Plane. Validate it end to end before treating it as confirmed.

5. Paste the Consumer Key into Client ID.
6. Leave Client Secret (optional) empty.
7. Select Attach Identity Provider.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Salesforce’s MCP documentation.