docs(salesforce): correct the setup steps that would strand an admin by waleedlatif1 · Pull Request #6526 · simstudioai/sim

waleedlatif1 · 2026-08-11T03:20:31Z

Summary

Follow-up to #6508. Verified the Salesforce integration-user guide against Salesforce's current UI and first-party docs before we point a customer at it. Most of it holds; four things do not, and one of them is the likeliest way a JWT setup fails.

The Client Credentials step pointed at the wrong screen. It told admins to check Enable Client Credentials Flow under OAuth Policies. On an External Client App that checkbox is under Edit Settings → OAuth Settings; the Policies page holds only the Run As picker. Anyone following it literally hunts for a control that isn't there. The FAQ answer inherited the same conflation.
Pre-authorizing the app must go through the profile or a second permission set. A permission set backed by the Salesforce API Integration license cannot hold an Assigned Connected Apps section at all (KB 001453686), so the app can never be assigned from the same permission set that grants object access — producing exactly the user hasn't approved this consumer failure that step exists to prevent.
RSA ≥2048 only. An ECDSA key is silently rejected, and the uploaded certificate must stay under 4 KB.
The JWT toggle doesn't appear until Enable OAuth is on, and the upload control is Upload Files.

Also scopes the capability promise for the API-only license, so we don't advertise something untested:

SOQL and CRUD on standard objects — supported.
Reports and dashboards — genuinely unverified in either direction from first-party docs. Flagged as needing a sandbox test rather than asserted.
Apex Class Access is a permission this license cannot hold, so Tooling API calls touching ApexClass will fail. Custom field/object management is unaffected.

Verified as accurate and left alone: External Client App is the right object, Connected App creation is disabled org-wide since Spring '26, the openssl command and a 10-year self-signed cert are fine, the My Domain formats are current post-Enhanced-Domains, and "Admin approved users are pre-authorized" is the verbatim current label.

Type of Change

Documentation

Testing

fumadocs-mdx + tsc --noEmit clean, biome clean, MDX component nesting balanced and the FAQ block still parses.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Verified the guide against Salesforce's current UI and docs. Most of it holds; these do not: - The Client Credentials step told admins to check "Enable Client Credentials Flow" under OAuth Policies. On an External Client App that checkbox is under Edit Settings → OAuth Settings; the Policies page holds only the Run As picker, so anyone following it literally hunts for a control that is not on the screen. The FAQ answer inherited the same conflation. - Pre-authorizing the app must go through the profile or a SECOND permission set. A permission set backed by the Salesforce API Integration license cannot hold an Assigned Connected Apps section at all, so the app can never be assigned from the same permission set that grants object access — which produces exactly the "user hasn't approved this consumer" failure that step exists to prevent. This is the likeliest way a JWT setup fails. - Salesforce requires an RSA key of at least 2048 bits; an ECDSA key is silently rejected, and the certificate must stay under 4 KB. - The JWT toggle does not appear until Enable OAuth is on, and the control is "Upload Files". Also scopes the capability promise for the API-only license: SOQL and CRUD on standard objects are supported, reports and dashboards are genuinely unverified in either direction, and Apex Class Access is a permission this license cannot hold, so Tooling API calls touching ApexClass will fail.

vercel · 2026-08-11T03:20:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 11, 2026 3:30am

cursor · 2026-08-11T03:20:43Z

PR Summary

Low Risk
Documentation-only changes to the Salesforce integration guide; no application code, auth, or data paths modified.

Overview
Updates the Salesforce integration user guide so admins follow the right Salesforce UI paths and avoid common JWT / Client Credentials failures.

Client credentials: Step 2 now points to Edit Settings → API (Enable OAuth Settings) for Enable OAuth. Step 3 clarifies that Enable Client Credentials Flow lives in OAuth Settings (step 2), while Policies only sets Run As—fixing instructions that sent people hunting for a checkbox on the wrong screen.

JWT bearer: Adds warnings for RSA ≥2048 keys and 4 KB cert limit; notes Enable OAuth must be on before the JWT toggle and to use Upload Files for server.crt. Adds a critical callout that app pre-authorization must use the profile or a second permission set without the Salesforce API Integration license—assigning from the object-access permission set cannot work and causes user hasn't approved this consumer.

My Domain: Corrects Developer Edition host to yourorg.develop.my.salesforce.com (with -dev-ed only when Salesforce generated the name); FAQ aligned.

API-only license: New callout limits the promise—SOQL/CRUD on standard objects OK; reports/dashboards unverified; Apex Class Access blocked on Tooling API ApexClass calls.

^{Reviewed by Cursor Bugbot for commit fcf8167. Configure here.}

greptile-apps · 2026-08-11T03:22:31Z

Greptile Summary

The documentation now corrects Salesforce External Client App setup instructions and clarifies JWT, permission-set, API-only license, and My Domain requirements.

Separates Client Credentials enablement from the Run As policy configuration.
Documents RSA certificate and JWT pre-authorization constraints.
Qualifies API-only license support for reports, dashboards, and Apex.
Makes Developer Edition hostname guidance consistent between setup and FAQ sections.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/docs/content/docs/en/integrations/salesforce-service-account.mdx	Updates the Salesforce service-account guide, including a complete fix for the previously conflicting Developer Edition hostname instructions.

_{Reviews (2): Last reviewed commit: "docs(salesforce): align the Developer Ed..." | Re-trigger Greptile}

…e setup section The setup section was corrected to make the `-dev-ed` suffix conditional, but the FAQ still presented it as mandatory — so an admin whose Developer Edition domain lacks the generated suffix would read two contradictory formats on the same page and validate against a host that does not exist.

waleedlatif1 · 2026-08-11T03:25:10Z

@greptile

waleedlatif1 · 2026-08-11T03:25:17Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fcf8167. Configure here.}

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread apps/docs/content/docs/en/integrations/salesforce-service-account.mdx

cursor Bot reviewed Aug 11, 2026

View reviewed changes

vercel Bot deployed to Preview August 11, 2026 03:30 View deployment

waleedlatif1 merged commit daac4f3 into staging Aug 11, 2026
6 checks passed

waleedlatif1 deleted the salesforce-docs-accuracy branch August 11, 2026 03:33

This was referenced Aug 11, 2026

v0.8.0: new workflow UI, v2 API, salesforce JWT, provenance improvements, incidentio tools, block retries #6533

Closed

v0.8.0: desktop app, workflow UI, v2 endpoints #6606

Merged

Navigation Menu

Uh oh!

docs(salesforce): correct the setup steps that would strand an admin - #6526

docs(salesforce): correct the setup steps that would strand an admin#6526
waleedlatif1 merged 2 commits into
stagingfrom
salesforce-docs-accuracy

waleedlatif1 commented Aug 11, 2026

Uh oh!

vercel Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 11, 2026 •

edited

Loading

Important Files Changed

Uh oh!

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Aug 11, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Aug 11, 2026 •

edited

Loading

cursor Bot commented Aug 11, 2026 •

edited

Loading

greptile-apps Bot commented Aug 11, 2026 •

edited

Loading