> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usepropane.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Salesforce (MCP connector)

> Connect Propane to Salesforce with a read-only integration user—profile permissions, license choice, and OAuth.

<Info>
  This guide is for the **Salesforce MCP connector** (per-user session context). It is **not** an org-wide **Integration**. For Context ingestion and Signals, see [What integrations bring in](/context/integrations/what-they-bring-in).
</Info>

Propane connects to Salesforce through **OAuth**. The cleanest setup is a dedicated integration user with read-only permissions — not an admin account. Plan for a few minutes in Salesforce Setup, then authenticate in Propane as that user.

## Where to find connectors in Propane

There are two ways to reach the connectors panel:

**From a chat session** — Click the **+** icon in the composer and select **Connectors**. A side panel opens showing every connector available in Propane. Find **Salesforce** in the list to start setup.

**From Settings** — Go to **Settings → Connectors**. You will see the full list of available connectors, including **Salesforce**. Click **Connect** to begin.

Both paths lead to the same setup flow. Create the integration user in Salesforce first, then return to Propane to complete OAuth.

<Warning>
  **Your Salesforce admin may need to approve Propane on first connection.** Since September 2025, Salesforce blocks self-authorization for connected apps in customer orgs by default. An admin can pre-approve Propane in **Setup → Connected Apps OAuth Usage** — click **Install**, then assign a permission set or profile. This is a customer-side control; it cannot be bypassed from Propane.
</Warning>

<Steps>
  <Step title="Create a read-only profile">
    In Salesforce, permissions are controlled via **Profiles** or **Permission Sets**. A cloned read-only profile is the simplest approach for a connector user.

    1. Go to **Setup** → search **Profiles** → click it.
    2. Find the **Standard User** profile → click **Clone**.
    3. Name it something like **Integration Read Only**.
    4. In the cloned profile, open **Object Permissions** and, for every object:
       * Uncheck **Create**, **Edit**, **Delete**, and **Modify All**.
       * Keep only **Read** and **View All** checked.
    5. **Save** the profile.

    <Tip>
      If your org prefers Permission Sets over profiles, you can attach a read-only permission set to a standard user instead. The goal is the same: read access only, no create, edit, or delete.
    </Tip>
  </Step>

  <Step title="Create the integration user">
    1. Go to **Setup** → search **Users** → **New User**.
    2. Fill in the details (for example, `integration@yourcompany.com`).
    3. Set **Profile** to your new **Integration Read Only** profile.
    4. Set **License** to **Salesforce** (this uses a full license seat) or **Salesforce Integration** if your org has it — the Integration license is cheaper and designed for API-only access with no UI login.
    5. **Save** the user.

    <Note>
      **Salesforce Integration license** — If your org has the **Salesforce Integration** user license available, use it for this connector. It costs less than a full seat and is intended for API-only integrations like Propane.
    </Note>
  </Step>

  <Step title="Activate the account">
    Salesforce sends an activation email to the integration user's address. Complete activation and set a password so the account is live and can authenticate.

    <Warning>
      Store the integration user's credentials securely. Anyone with access to this account can read Salesforce data within the permissions you granted.
    </Warning>
  </Step>

  <Step title="Connect in Propane">
    Return to the **Connectors** panel in Propane (either via the **+** in the composer or from **Settings → Connectors**). Find **Salesforce** and start the OAuth flow.

    When prompted, sign in as your **integration user** — not an admin or personal account. Propane will request only the access needed to read context for your session.

    If OAuth is blocked on first try, ask your Salesforce admin to complete the Connected Apps approval above, then retry.

    <Check>
      That is it — Propane will start pulling context from Salesforce on your next session.
    </Check>
  </Step>
</Steps>

## Related

* [Connectors](/settings/connectors)