How to connect Salesforce

This integration lets Tulina read and write to your Salesforce — contacts, accounts, leads, opportunities and notes — on behalf of your organisation.

Who can do this. A Salesforce administrator, with rights to create an External Client App. On the Tulina side, an org member, or an org or team admin if you want the connection shared.

How long it takes. 10 to 15 minutes.

Salesforce does not allow one OAuth client to be shared across companies, so every organisation creates its own app inside its own Salesforce. That is expected, and it is exactly what this guide walks through.

Step 1 — Create the External Client App in Salesforce

To go straight there, append /lightning/setup/ManageExternalClientApplication/home to your Salesforce domain. Otherwise:

1. In Salesforce, open Setup (the gear icon, top right).
2. In Quick Find, type External Client Apps, then click External Client App Manager. If your org only shows the older menu, look for App Manager → New Connected App instead — same idea, slightly different labels.
3. Click New External Client App.
4. Fill in the basic information:
   • App name — for example, Tulina
   • Contact Email — your own email address
   • Distribution State — Local
5. Under API (Enable OAuth Settings), check Enable OAuth Settings, then set:
   • Callback URL — copy and paste exactly https://mcp.oto.cx/api/salesforce/oauth/callback
   • Selected OAuth Scopes — add at least Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access)
   • Leave Require Secret for the Web Server Flow checked. That is the standard setting for a server-side integration.
6. Save.

Step 2 — Let the API calls through

By default, Salesforce can block API calls based on the IP address they come from. To stop that blocking Tulina:

1. From your app's page, go to Manage → Edit Policies, or the Policies tab for an External Client App.
2. Under OAuth Policies → IP Relaxation, choose Relax IP restrictions.

There is no field here for allowing one specific address: this is a simple on-or-off toggle for whether your org's IP restrictions apply to this app. Relaxing them is the simplest and most common choice for an integration like this one.

If your security policy requires IP restrictions to stay enforced everywhere, the alternative is Setup → Network Access, adding Tulina's outbound address as a Trusted IP Range — 151.115.148.128 in both Start IP Address and End IP Address, so that only that one address is allowed. Note that this applies across the whole org rather than to this app alone, so keep it for cases where relaxing is not acceptable to you.

Step 3 — Retrieve the consumer key and secret

1. Still on the app's page, click Manage Consumer Details.
2. Salesforce asks you to verify your identity, with a code sent by email or through your authenticator app. Confirm it.
3. Copy and keep safe both the Consumer Key (the client ID) and the Consumer Secret (the client secret).

Give Salesforce 5 to 10 minutes after creating the app before you connect. A brand-new app takes a little while to propagate.

Step 4 — Connect Salesforce from Tulina

1. In Tulina, go to Connectors.
2. Find the Salesforce card and click Connect Salesforce.
3. Fill in the three fields:
   • Consumer Key — the one you copied in step 3
   • Consumer Secret — the one you copied in step 3
   • Login URL — your org's login URL, of the form https://yourcompany.my.salesforce.com
4. Confirm, then click Connect. You are sent to Salesforce to authorise access on the OAuth consent screen, and once you approve it you land back with Salesforce connected.

One prerequisite on the Salesforce side: the account authorising the connection needs the API Enabled permission, on its profile or through a permission set. Without it the connection fails even when the credentials are correct.

Troubleshooting

"Invalid client", or "invalid client id". The consumer key or secret was copied with a stray space — or the app has not propagated yet, in which case wait a few minutes and try again.

An IP-related error, or access denied. Go back to step 2 and check IP Relaxation.

No refresh token, or the connection does not persist. Check that the Perform requests at any time (refresh_token, offline_access) scope was selected in step 1.

A callback or redirect_uri mismatch. The Callback URL in Salesforce has to match exactly, character for character: https://mcp.oto.cx/api/salesforce/oauth/callback