Salesforce

Connect Salesforce to surface every Einstein prediction, Agentforce invocation, Flow run, and Apex-triggered automation operating in your org. The OAuth connector polls the Salesforce REST + Tooling APIs on a 15-minute cadence and registers each Einstein model + Flow + Agentforce topic as an observed agent.

What gets observed

  • Agentforce (formerly Einstein Copilot) — topic invocations + handoffs + action calls.
  • Einstein GPT / Prompt Builder — prompt-template runs + per-org counts.
  • Einstein Bots — conversation envelopes + transfer events.
  • Flow + Process Builder — definitions and last-run summaries.
  • Connected Apps + named credentials inventory.
  • Setup Audit Trail entries for sensitive admin changes.

Conversation bodies and Einstein prompt content are not stored — the connector reads metadata envelopes only. For prompt-level fidelity on Prompt Builder calls, route through the collector LLM proxy.

Setup

Salesforce connects with one-click OAuth — there is no Connected App to create and no keys to paste. Trefur owns the OAuth application and the redirect, so you never configure a callback URL.

  1. Sign in to app.trefur.com as an account owner or admin.
  2. Open Integrations → Salesforce → Connect.
  3. You're bounced through Salesforce's OAuth consent screen. Approve the requested scopes. [Screenshot: Salesforce consent screen]
  4. On success Trefur stores a refresh token in the credential vault and kicks off an instant scan. Initial scan completes in 1-3 minutes depending on org size.

OAuth scopes requested

ScopeWhat it grants
apiAccess to the Salesforce REST + Tooling APIs.
refresh_tokenAllows long-lived refresh.

Troubleshooting

SymptomFix
Agentforce / Einstein endpoints return 404.The org must have the relevant feature licensed (Agentforce, Einstein for Service, Einstein for Sales). Connector inventories Flow + audit trail regardless.
invalid_grant: IP restricted.Your org enforces login-IP ranges. Add Trefur's outbound CIDR to your org's trusted IP ranges (Setup → Network Access), or relax the restriction for the connected session.
Refresh token revoked.Salesforce admins can revoke Trefur's access under Setup → Connected Apps OAuth Usage. After a revoke you must re-run the connect flow.

Back to all integrations.