Salesforce

Polytomic connects to Salesforce as a Salesforce user. Every sync reads and writes with that user's permissions. In addition to the data you sync, some features need access to related records and Salesforce setup data.

We recommend you create a user in Salesforce exclusively for Polytomic. This keeps Polytomic's activity separate in Salesforce's audit logs and lets you scope its access with permission sets.

This page covers connecting to Salesforce. For sync behavior, see Syncing from Salesforce and Syncing to Salesforce.

📘

Salesforce sandbox

Connecting Polytomic to a Salesforce sandbox works the same way as connecting to a production instance. If you have a sandbox, we recommend you create two Connections in Polytomic: one to your sandbox for testing and one to your production instance.

Salesforce user permissions

The Salesforce user that Polytomic connects as must have these permissions:

• API Enabled. An integration user with the Minimum Access - API Only Integrations profile has it.
• View Setup and Configuration. Polytomic reads your Salesforce organization's API limits when you connect, and uses them to set its daily API-call limit.

The user also needs access to the data you sync:

The objects and fields available in Polytomic depend on your Salesforce user's access and Polytomic's support for them. If an object or field is missing, check the user's object permissions and field-level security.

Object permissions don't make every record visible. Salesforce sharing settings also affect which records Polytomic can read. If you need to sync every record of an object, make sure your Salesforce user can read every record.

When you connect, Polytomic also reads Id and TimeZoneSidKey from Organization to identify your Salesforce organization and its time zone.

Some features need more:

Grant access for the objects, fields, and features you use rather than assigning a System Administrator profile by default.

Create a connection

Polytomic supports two authentication methods:

• OAuth: you sign in to Salesforce as the Polytomic user in your browser.
• Client credentials: Polytomic authenticates with the client ID and secret of a connected app or external client app in your Salesforce organization. Salesforce runs every request as the app's Run As user. Use this method when no one should sign in interactively.

OAuth

1. In Polytomic, go to Connections → Add connection → Salesforce.

2. Enter a Connection name and your Salesforce Domain. The domain is usually in the format foocorp.my.salesforce.com. You can also enter just the unique ID, foocorp in this case.

3. For Authentication method, select OAuth.

4. Click Connect to Salesforce and sign in as the Polytomic user. After you authenticate, Polytomic shows the connected username:

5. Click Save.

Salesforce connected app restrictions

Salesforce restricts access to uninstalled connected apps. These restrictions may affect creating an OAuth Connection or using Force reconnect.

Your Salesforce administrator can install the Polytomic connected app and grant your integration user access through the app's policies. Installed apps and some previously authorized apps can continue to work without a bypass permission.

For an uninstalled app, Approve Uninstalled Connected Apps permits self-authorization where Salesforce policy allows it. Use Any API Client provides a broader bypass for uninstalled or blocked apps, including restrictions under API Access Control. Your administrator must choose the appropriate access policy for your Salesforce organization.

Client credentials

First, set up an app in Salesforce:

1. In Salesforce Setup, configure a connected app or external client app with OAuth enabled. Follow Salesforce's setup instructions for your app type. Polytomic's client credentials flow doesn't use a callback URL.
2. Add the Manage user data via APIs (api) OAuth scope.
3. Enable the client credentials flow.
4. In the app's policies, set the Run As user to the Polytomic user. See Salesforce user permissions for the permissions it needs.
5. Copy the app's consumer key and consumer secret.

For details, see Salesforce's guide to configuring a connected app for the client credentials flow.

Then create the connection in Polytomic:

1. Go to Connections → Add connection → Salesforce.
2. Enter a Connection name and your Salesforce Domain.
3. For Authentication method, select Client credentials.
4. Enter the consumer key as the Client ID and the consumer secret as the Client secret.
5. Click Save.

When you save the Connection, Polytomic requests an access token using the client ID and secret. Polytomic shows the Salesforce username returned with the token's details. When the token needs refreshing, Polytomic requests another token using the same client credentials.

📘

Changing the Run As user

To change which Salesforce user Polytomic connects as, change the app's Run As user in Salesforce. The change takes effect in Polytomic when it obtains a new access token. To request a new token after changing the user, save the Connection in Polytomic and check the displayed Salesforce username.

Connection maintenance

• When Polytomic can read your Salesforce organization's API limit, it caps its own daily API calls at 75% of that limit. To set your own limit, select Enforce API limits and enter a Daily call limit. See Managing Salesforce API consumption.
• To change the Salesforce user on an OAuth Connection, click Force reconnect and sign in as the new user.