Salesforce setup guide

Agents look up customers and deals and keep your records tidy.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Salesforce, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Salesforce can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

Your External Client App (sign in as a user)

Your OAuth app.

This way signs in with an OAuth app you create for Salesforce, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

Its OAuth app belongs to one company and is tied to the token endpoint it was registered for: Everdeck sends the app’s secret only there.

1. In Salesforce Setup, search Quick Find for External Client App Manager and click New External Client App.
2. Enter an app name (for example "Everdeck") and a contact email. Under API (Enable OAuth Settings) tick Enable OAuth, set the Callback URL to https://everdeck.io/api/oauth/callback, and add the OAuth scopes "Manage user data via APIs (api)" and "Perform requests at any time (refresh_token, offline_access)".
3. Leave "Require secret for Web Server Flow", "Require secret for Refresh Token Flow" and "Require Proof Key for Code Exchange (PKCE)" ticked, then click Create.
4. Open the app from External Client App Manager; under OAuth Settings click Consumer Key and Secret (Salesforce emails you a verification code) and copy both here.
5. Enter your My Domain URL (a sandbox looks like https://yourcompany--sandboxname.sandbox.my.salesforce.com), click Connect and sign in as the Salesforce user the agent should act as. Triggers (a new lead, a changed opportunity, a new case): set them up on the Intake page. Everdeck checks Salesforce every 5 minutes with a SOQL query through this connection, so nothing more is needed here. The user needs read access to leads, opportunities and cases, and each check counts towards your org's daily API request limit.

Field	What to enter
My Domain login URL	Web address. For example https://yourcompany.my.salesforce.com.

The scopes Everdeck asks for:

• api
• refresh_token

When you disconnect, Everdeck asks Salesforce to revoke the sign-in, then deletes the tokens it saved.

Your External Client App (integration user, no sign-in)

Your OAuth app.

This way uses the client ID and secret of an OAuth app you create for Salesforce. There’s no sign-in page: Everdeck asks Salesforce for a token with them.

Its OAuth app belongs to one company and is tied to the token endpoint it was registered for: Everdeck sends the app’s secret only there.

1. Pick the Salesforce user the agent should act as. External Client Apps require this Run As user to have the API Only User permission; a user with the Salesforce Integration license and a permission set limited to the objects it needs works best.
2. In Setup > External Client App Manager click New External Client App. Under API (Enable OAuth Settings) tick Enable OAuth, enter the callback URL https://everdeck.io/api/oauth/callback, add the scope "Manage user data via APIs (api)", and under Flow Enablement tick Enable Client Credentials Flow. Click Create.
3. On the app's Policies tab click Edit. Under OAuth Flows and External Client App Enhancements tick Enable Client Credentials Flow and set Run As (Username) to the user from step 1. Save.
4. Under OAuth Settings click Consumer Key and Secret and copy both here, with your My Domain URL. Triggers (a new lead, a changed opportunity, a new case): set them up on the Intake page. Everdeck checks Salesforce every 5 minutes with a SOQL query through this connection, so nothing more is needed here. The user needs read access to leads, opportunities and cases, and each check counts towards your org's daily API request limit.

Field	What to enter
My Domain URL	Web address. For example https://yourcompany.my.salesforce.com.

Disconnecting deletes the access token Everdeck saved for this connection. The OAuth app's client ID and secret stay saved under OAuth apps in Everdeck and keep working at Salesforce until you delete the app or rotate its secret there.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• Query records (SOQL)Tier 0 · ReadReads outside contentsalesforce_query

  Run a SOQL query, for example SELECT Id, Name, StageName, Amount, CloseDate FROM Opportunity WHERE IsClosed = false ORDER BY CloseDate LIMIT 20. Select only the fields you need and always add LIMIT. Relationship fields work (Account.Name). Results respect the connected user's sharing. Datetimes in WHERE use 2026-10-08T09:00:00Z or relative literals like LAST_N_DAYS:7.

• Search recordsTier 0 · ReadReads outside contentsalesforce_search

  Free-text search across objects (names, emails, phone numbers and other text fields), like the global search box. Returns matching records with Id, type and the requested fields. Search results can lag recent changes by a few minutes; use query for exact lookups.

• Read a recordTier 0 · ReadReads outside contentsalesforce_get_record

  Read one record by object name and Id, optionally only some fields.

• Describe an objectTier 0 · ReadReads outside contentsalesforce_describe_object

  List an object's fields: API name, label, type, whether it is required or editable, lookup targets and picklist values. Use before creating or updating records on unfamiliar objects.

• Create a recordTier 2 · ReversibleReads outside contentsalesforce_create_record

  Create a CRM record, for example a Lead (LastName and Company required), Contact (LastName), Account (Name) or Opportunity (Name, StageName, CloseDate), or a custom object record. Returns the new Id. Duplicate and validation rules apply.

• Update a recordTier 2 · ReversibleReads outside contentsalesforce_update_record

  Change fields on an existing record; send only the fields to change. Move an opportunity by setting StageName, reassign with OwnerId, close a case with Status. Returns nothing on success.

• Log a task or callTier 2 · ReversibleReads outside contentsalesforce_log_task

  Create a Task: a follow-up to-do, or a record of a call or email that already happened (Status Completed, TaskSubtype Call). WhoId links a Contact or Lead; WhatId links an Account, Opportunity, Case or other record. Internal only; nothing is sent.

• Post on a record's feedTier 2 · ReversibleReads outside contentsalesforce_post_to_chatter

  Post a comment to the Chatter feed of a record (or a user or group) so the team sees it. Mention someone with @[userId]. Visible to internal users who can see the record.

• Send an emailTier 3 · ExternalReads outside contentsalesforce_send_email

  Send an email through Salesforce from the connected user (or an org-wide address). Set recipient_id (Contact or Lead) and log_email to record it on that person's activity timeline.

What can start work

These events from Salesforce can become tasks for your agents through Intake. How Intake works.

A new lead was created.

Connect Salesforce first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

An opportunity was created or edited (stage, amount, close date, owner and other fields).

Connect Salesforce first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

A new case was created.

Connect Salesforce first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Salesforce later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Salesforce, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.