Skip to content
Status

Salesforce

Connect to Salesforce hosted MCP servers using the Speakeasy application with a required support handoff or your own External Client App, selecting the appropriate endpoint and org type.

Use Salesforce System Administrator credentials for an API-enabled production or sandbox org where Hosted MCP Servers are available. Salesforce documents availability for Enterprise Edition and above. You need authority to install the Speakeasy application or create an External Client App, and enable Hosted MCP Servers.

Sign in to the Salesforce org you want to connect. Install or create the app in that same org. This guide does not cover scratch orgs. For a lower-edition org, confirm Hosted MCP availability in Salesforce Setup before starting either path.

Open Salesforce Setup

  1. At the top of any Salesforce page, select the setup gear icon.
  2. Select Setup.

For a lower-edition org:

  1. In Quick Find, enter MCP Servers.
  2. Select MCP Servers under API Catalog.
  3. Confirm that Hosted MCP Servers are available in the target org before continuing.

Choose one path: use Speakeasy’s Salesforce app and finish OAuth with support, or create your own Salesforce app and connect it yourself.

Use Speakeasy’s Salesforce app

Install Speakeasy’s Salesforce application

Open this installation URL to install Speakeasy’s Salesforce application into the intended org:

https://login.salesforce.com/packaging/installPackage.apexp?p0=04tdM000000cNGXQA2

Contact Speakeasy support to finish OAuth

After installation, contact Speakeasy support to finish OAuth setup. Installation alone does not complete OAuth. Coordinate your selected endpoint and server activation with support. Your next step is with support—not the app-creation walkthrough below.

Create your own Salesforce app

Before creating the app, choose a server in the endpoint reference and confirm its prerequisites. Then create an External Client App in the org you want to connect and enable that server.

This path uses the app’s Consumer Key without a client secret. Salesforce documents this configuration for compatible public clients; it has not been verified with the Speakeasy AI Control Plane.

Start an External Client App

  1. In Quick Find, enter external client.
  2. Select External Client App Manager.
  3. Select New External Client App.
  4. Under Basic Information, enter a descriptive App Name, such as Speakeasy MCP.
  5. Accept the generated API Name.
  6. Enter the responsible administrator’s or application owner’s email address in Contact Email.
  7. Set Distribution State to Local.

Configure OAuth settings

  1. Expand API (Enable OAuth Settings).

  2. Select Enable OAuth.

  3. In Callback URL, enter this value:

    https://ai.speakeasy.com/mcp/remote_login_callback

  4. In Available OAuth Scopes, select Access MCP servers (mcp_api).

  5. Select the right-arrow control to move it to Selected OAuth Scopes.

  6. In Available OAuth Scopes, select Perform requests at any time (refresh_token).

  7. Select the right-arrow control to move it to Selected OAuth Scopes.

  8. Under Security, select Issue JSON Web Token (JWT)-based access tokens for named users.

  9. Leave Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows deselected.

  10. Leave Require Secret for Web Server Flow deselected.

  11. Leave Require Secret for Refresh Token Flow deselected.

  12. Leave all other Security options that can be changed without Salesforce support deselected.

Create the External Client App

Select Create.

The app can take up to 30 minutes to become operational. If sign-in fails immediately, allow that window before retrying.

Copy the Consumer Key

  1. On the saved External Client App, select Settings.
  2. Under OAuth Settings, select Consumer Key and Secret.
  3. Complete the Salesforce verification prompt if it appears.
  4. Copy Consumer Key. You will use it as the Speakeasy Client ID.

Do not copy the Consumer Secret for this path.

Enable the selected MCP server

Choose the least-privileged server that meets your team’s needs using the endpoint reference below. If you are unsure which capabilities are approved, ask the application or cloud security owner before enabling a server.

  1. Return to Setup.
  2. In Quick Find, enter MCP Servers.
  3. Select MCP Servers under API Catalog.
  4. Find the server whose API ID matches the approved choice.
  5. Use the available control to enable that server. For Headless 360, find headless-360 and select Activate.
  6. Record its URL from the endpoint reference below.
  7. Wait up to two minutes for the server to become active.

If you created your own app, continue to Speakeasy setup with your selected URL and Consumer Key. If you installed Speakeasy’s app, continue with Speakeasy support.

Endpoint reference

Copy the production or sandbox URL for your selected server. It must match the org where you created the app and enabled the server.

SObject Reads (sobject-reads)

Discovery, query, search, and relationship traversal; no record changes.

Production:

https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads

Sandbox:

https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-reads

SObject Mutations (sobject-mutations)

Read, create, and update records; no deletes.

Production:

https://api.salesforce.com/platform/mcp/v1/platform/sobject-mutations

Sandbox:

https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-mutations

SObject Deletes (sobject-deletes)

Identify and delete records; no creates or updates.

Production:

https://api.salesforce.com/platform/mcp/v1/platform/sobject-deletes

Sandbox:

https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-deletes

SObject All (sobject-all)

Create, read, update, delete, query, and search records.

Production:

https://api.salesforce.com/platform/mcp/v1/platform/sobject-all

Sandbox:

https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all

Data 360 (data360)

Query data and change customer-data configuration. Requires a Data 360 license, API v66.0+, and Manage Data 360 for configuration or View Data 360 for read-only operations.

Production:

https://api.salesforce.com/platform/mcp/v1/data/data360

Sandbox:

https://api.salesforce.com/platform/mcp/v1/data/sandbox/data360

Headless 360 (Beta) (platform/headless-360)

Broad Setup and platform operations, not read-only record access. Available starting July 2026 under Beta Services Terms. Requires API v67.0+, an External Client App with mcp_api, and an OAuth client.

Production:

https://api.salesforce.com/platform/mcp/v1/platform/headless-360

Sandbox:

https://api.salesforce.com/platform/mcp/v1/sandbox/platform/headless-360

Tableau Next (analytics/tableau-next)

Semantic-model and analytics access. Confirm the org has the required Tableau Next capabilities.

Production:

https://api.salesforce.com/platform/mcp/v1/analytics/tableau-next

Sandbox:

https://api.salesforce.com/platform/mcp/v1/sandbox/analytics/tableau-next

Calls remain subject to the signed-in user’s field-level security, object permissions, and sharing rules. If the connection fails with valid credentials, confirm that the selected server is enabled, the URL matches the selected server, and the org has API access.

Follow these steps after creating your own Salesforce app and enabling your selected MCP server. If you installed Speakeasy’s Salesforce app instead, contact Speakeasy support to finish OAuth.

Add the server in Speakeasy

  1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.
  2. Click Add new to open Add MCP server.
  3. Choose Hosted remotely.
  4. On New remote MCP server, paste the URL recorded in Enable the selected MCP server into MCP server URL.
  5. Leave User session issuer at its default.
  6. Click Verify connectivity.
  7. Under Identity, select User Identity. The page preselects No Identity for Salesforce URLs, so change it.
  8. Click Save.

Speakeasy cannot register a Salesforce client automatically. It keeps the server Disabled and says to finish setup in Settings > Identity. This is expected.

Connect your credentials

Open the server’s Settings and find the Identity section.

  1. Confirm that User Identity is selected.

  2. Under Choose an identity provider, confirm the preselected provider is https://login.salesforce.com for a production URL or https://test.salesforce.com for a sandbox URL. A provider badged Will be created is expected. If a sandbox URL shows https://login.salesforce.com, open the picker (Search identity providers…) and choose https://test.salesforce.com.

  3. Under the provider, choose Manual. The dashboard preselects Auto-Configure, which fails for Salesforce. If an earlier Salesforce server already uses this app, Existing client is preselected instead: pick that client under Client and skip to step 7.

  4. Paste the Consumer Key into Client ID.

  5. Leave Client secret empty.

  6. Open Advanced and enter this value in Scope. Do not leave it blank.

    mcp_api refresh_token

  7. Click Save. If asked to confirm, click Save changes.

If a sandbox URL offers no https://test.salesforce.com provider, create one, then return to step 7:

  1. Open the picker and click Create a custom identity provider. This opens Remote Identity Providers.
  2. Click New Remote Identity Provider.
  3. Enter https://test.salesforce.com in Issuer URL.
  4. Click Discover and keep the derived Slug.
  5. Click Create.
  6. On the new provider, click Add Client.
  7. Set Client Type to Manual.
  8. Paste the Consumer Key into Client ID and leave Client Secret (optional) empty.
  9. Enter mcp_api,refresh_token in Scope (override).
  10. Confirm the displayed Redirect URI matches the Callback URL you entered in Salesforce.
  11. Click Create.
  12. Return to the server’s Settings > Identity and select that provider.
  13. Choose Existing client and pick the new client under Client.

Turn the server on:

  1. In Settings > Danger Zone > Server Availability, turn on Enable MCP server.
  2. Confirm it shows Enabled.

When a person first uses the server, Salesforce asks them to sign in and allow access. If sign-in fails right after you created the app, wait out Salesforce’s 30-minute activation window before retrying. Do not change the OAuth settings.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Salesforce’s MCP documentation.