Connect Claude Desktop to Salesforce

Your sales team wants to ask Claude questions about their pipeline. “What’s the status of the Acme deal?” “Show me all contacts at GlobalCorp.” “When was the last activity on the Initech account?”

The naive approach: give Claude a Salesforce API key. The problem: every user sees every record. There’s no way to scope access per person. There’s no audit trail of who queried what. And when the API key leaks, everyone with it has full CRM access.

ACP solves this by sitting between Claude Desktop and Salesforce, verifying each user’s identity on every request. Your sales reps authenticate with their existing SSO — Auth0, Okta, Google, whatever you use — and ACP ensures every Salesforce query is scoped to their permissions and logged.

Here’s how to set it up.

Prerequisites

• An ACP Cloud account (sign up free)
• A Salesforce org with API access enabled
• Claude Desktop installed
• An identity provider (Auth0, Okta, Google, or any OIDC provider)

Step 1: Create a workspace

Sign in to ACP Cloud and create a workspace. Pick a slug — this becomes your MCP endpoint URL:

https://api.makeagents.run/{your-slug}

This is the URL you’ll give Claude Desktop.

Step 2: Connect your identity provider

Go to Settings → Identity Providers in the dashboard. You need three values from your IdP:

ACP fetches your IdP’s public keys automatically from the JWKS endpoint. No shared secrets. No webhook configuration.

Claim mapping

Different IdPs put user data in different JWT claims. Configure the mapping:

• Scope claim: scope (Auth0) or scp (Okta/Entra)
• Role claim: permissions (Auth0) or groups (Okta) or roles (Entra)
• Tenant claim: org_id (Auth0 Organizations) or custom

Step 3: Enable the Salesforce connector

Go to Connectors → Salesforce in the dashboard. Click Connect to start the OAuth flow.

ACP uses OAuth 2.0 with PKCE to connect to Salesforce. You’ll authorize ACP to access your Salesforce org, and ACP stores the tokens encrypted per-user. Each user authenticates with their own Salesforce account — not a shared service credential.

Once connected, ACP exposes these Salesforce tools:

Scope the permissions

Under Policies → Tool Scopes, you can restrict which tools require which scopes:

{
  "salesforce.query": ["salesforce:read"],
  "salesforce.createRecord": ["salesforce:write"],
  "salesforce.updateRecord": ["salesforce:write"]
}

Now only users with salesforce:write in their JWT can create or update records. Read-only users can query and search but can’t modify data.

Step 4: Point Claude Desktop at your workspace

Open Claude Desktop’s MCP settings and add a new server:

{
  "mcpServers": {
    "my-company": {
      "url": "https://api.makeagents.run/your-slug",
      "transport": "streamable-http"
    }
  }
}

When you start a conversation and Claude tries to use Salesforce tools, it will prompt you to authenticate. Sign in with your company SSO — ACP verifies your JWT and grants access based on your scopes.

Step 5: Verify it works

Ask Claude: “What opportunities are closing this month?”

Behind the scenes:

1. Claude sends the tool call to https://api.makeagents.run/your-slug
2. ACP verifies your JWT against your IdP’s JWKS endpoint
3. ACP checks your scopes against the tool’s required scopes
4. ACP scans the query input for PII
5. ACP executes the Salesforce query with your per-user OAuth token
6. ACP logs the action: who queried, what tool, when, success/failure
7. The result flows back to Claude

Check the Logs page in the dashboard. You’ll see each tool call with:

• The user who made it (sub from their JWT)
• The tool called (salesforce.query)
• Latency, success/failure
• Content scan results (PII detected, risk score)

What you get

• Per-user identity — every Salesforce query is attributed to the person who asked, not a shared API key
• Scoped permissions — read-only users can’t create or update records
• PII scanning — SSNs, credit cards, and other PII are detected (and optionally redacted) before reaching Salesforce
• Audit trail — every query logged with full identity attribution, exportable via webhook to your SIEM
• Rate limits — per-user rate limits prevent any single user from hammering Salesforce
• Budget controls — per-user daily spend limits on LLM usage

Back to guides · Set up Auth0 → · Set up Okta →