Salesforce is a CRM platform for customer records, pipeline, service, and custom business objects. Use a connected app and integration user for a governed automation, or user-delegated OAuth for an interactive session.
This guide covers Salesforce-side setup for an MCP server. Dome does not currently provide a managed Salesforce agent template; connect the server directly and govern the resulting connection in your own workspace.
Choose a connection method
Choose a connected app with an integration user for a governed shared automation. Choose user-delegated OAuth for an interactive session that must preserve the user's sharing and field-level access. Salesforce's connected-app documentation explains the current OAuth flow and approval settings.
Recommended: Connected app and integration user
Use a Salesforce integration user with a purpose-built permission set rather than a human administrator account. Begin in a sandbox or developer org with test records.
- Create a Connected App in Salesforce Setup and enable OAuth.
- Register the exact callback URL from the MCP client; for Dome, use
https://api.domesystems.ai/oauth/callback. - Select the minimum OAuth scopes, then create a permission set that grants only the needed object, field, and record access.
- Assign that permission set to the integration user and complete OAuth as that user.
- Query a known test record and verify a record or field outside the permission set is denied or omitted.
Salesforce's connected-app documentation is authoritative for org policy, OAuth flow selection, and app approval.
Alternative: User-delegated OAuth
For a human's interactive MCP session, authorize that user through the connected app. Their profile, permission sets, sharing rules, and field-level security still constrain access. Do not use an integration user's refresh token for a human session.
- Open the vendor's OAuth documentation and confirm that this application or connected-app flow is supported for your account.
- Register the exact redirect URI supplied by the MCP client. For Dome, use
https://api.domesystems.ai/oauth/callback. - Authorize with the dedicated test identity, not an account owner, and approve only the intended workspace, project, or organization boundary.
- Confirm the authorized identity can read one known test record and cannot reach an unshared resource.
Verify Salesforce MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Salesforce MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Salesforce boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
invalid_grant normally means a redirect mismatch, expired authorization, or the wrong login domain. Successful OAuth with missing fields points to field-level security or sharing rules; fix the permission set rather than switching to System Administrator.
Next steps
Create a governed agent in Dome using the connected Salesforce server. Restrict it to the approved CRM objects and records, use a read-focused instruction set, and keep its model, tool, and access policies under review.
