Stay organized with collections
Save and categorize content based on your preferences.
This page describes how to configure a Salesforce instance for use with
Datastream.
Before you begin
Before you start configuring Salesforce for use with Datastream,
you need to:
Have access to an active Salesforce organization
Have knowledge of how to navigate and change settings in Salesforce
Have knowledge of how to create users and profiles in Salesforce
Configure a Salesforce organization for use with Datastream
To establish a connection between your Salesforce org and Datastream,
you need to authenticate either by using a username and a password, or by using
the OAuth 2.0 client credentials flow. To use the latter, you can create a
Salesforce connected app
or an external client app.
Make sure that the user profile has the permissions to read all
objects
and fields
that you want to include in your stream. For security reasons, consider granting
the user read-only permissions. For more information, see
Control who sees what
in the Salesforce documentation.
Optional: By default, Salesforce returns encrypted fields as masked fields.
If you need your user to view the actual values of encrypted fields, grant them
the View Encrypted Data permission. You can grant the permission by editing
the user's permission set.
Optional: Create and set up a connected app
Salesforce uses connected apps to integrate external applications with the
Salesforce API, integrate service providers with your Salesforce org,
or to control what data a third-party application can access from your Salesforce
organization. If you prefer to use a connected app to authenticate your Salesforce
instance in Datastream, perform the following steps:
Make sure that your connected app has the Manage user data via APIs (api)
scope enabled. For more information about scopes, see
OAuth tokens and scopes.
In Salesforce, enter App in the quick find box, and then select
App Manager.
Find your connected app in the list and expand the drop-down to the right
of the row.
Select View.
In the Manage connected apps details page, click
Manage consumer details.
A screen opens asking you for a verification code. An email with the verification
code is sent to the user to whom you assign the client credentials flow.
Enter the verification code. You are then redirected to the consumer
details page where you can find your key and secret. You need to provide the
consumer key and secret when you create your connection profile.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[[["\u003cp\u003eThis page outlines the steps to configure a Salesforce instance for use with Datastream, including authentication and user setup.\u003c/p\u003e\n"],["\u003cp\u003eBefore configuration, users need access to an active Salesforce organization and knowledge of Salesforce navigation, user creation, and profile adjustments.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication between Salesforce and Datastream can be established using a username and password, or via the OAuth 2.0 client credentials flow, potentially using a Salesforce connected app.\u003c/p\u003e\n"],["\u003cp\u003eTo ensure proper connectivity, Salesforce must allow access from Datastream IP addresses, and user profiles should have \u003ccode\u003eAPI Enabled\u003c/code\u003e permission along with read permissions for relevant objects and fields.\u003c/p\u003e\n"],["\u003cp\u003eConnected apps can be created and configured to integrate with the Salesforce API, and if chosen as an authentication method, require specific setup and the retrieval of a consumer key and secret.\u003c/p\u003e\n"]]],[],null,["# Configure a Salesforce org\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nThis page describes how to configure a Salesforce instance for use with\nDatastream.\n\nBefore you begin\n----------------\n\nBefore you start configuring Salesforce for use with Datastream,\nyou need to:\n\n- Have access to an active Salesforce organization\n- Have knowledge of how to navigate and change settings in Salesforce\n- Have knowledge of how to create users and profiles in Salesforce\n\nConfigure a Salesforce organization for use with Datastream\n-----------------------------------------------------------\n\nTo establish a connection between your Salesforce org and Datastream,\nyou need to authenticate either by using a username and a password, or by using\nthe OAuth 2.0 client credentials flow. To use the latter, you can create a\n[*Salesforce connected app*](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_overview.htm&type=5)\nor an [*external client app*](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&type=5).\n\nIf your Salesforce org is configured to allow access from specific IP addresses,\nmake sure that Salesforce accepts\n[Datastream IP addresses](/datastream/docs/ip-allowlists-and-regions).\nFor information about how to manage your network access restrictions, see [Network access and profile-based IP restrictions](https://help.salesforce.com/s/articleView?id=000386441&type=1)\nand [Set trusted IP ranges for your organization](https://help.salesforce.com/s/articleView?id=sf.security_networkaccess.htm)\nin the Salesforce documentation.\n\nConfigure a user\n----------------\n\n1. In Salesforce, either create a user, or adjust the settings for an existing user as per the instructions that follow.\n2. Create a dedicated profile and assign it to the user.\n3. If your organization has IP address restrictions configured, make sure that you add the [Datastream IP addresses](/datastream/docs/ip-allowlists-and-regions) to the list of allowed IP addresses. For more information, see [Restrict login IP addresses in profiles](https://help.salesforce.com/s/articleView?id=platform.login_ip_ranges.htm&type=5).\n4. Make sure that the user profile has the [`API Enabled`](https://help.salesforce.com/s/articleView?id=sf.branded_apps_commun_api_permset.htm&type=5) permission so that the user can use both the [Salesforce REST API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_what_is_rest_api.htm) and [Bulk API 2.0](https://developer.salesforce.com/docs/atlas.en-us.api_asynch.meta/api_asynch/bulk_api_2_0.htm).\n5. Make sure that the user profile has the permissions to read all [objects](https://help.salesforce.com/s/articleView?id=platform.users_profiles_object_perms.htm&type=5) and [fields](https://help.salesforce.com/s/articleView?id=platform.users_profiles_field_perms.htm&type=5) that you want to include in your stream. For security reasons, consider granting the user read-only permissions. For more information, see [Control who sees what](https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_data_access.htm) in the Salesforce documentation.\n6. Optional: By default, Salesforce returns encrypted fields as masked fields. If you need your user to view the actual values of encrypted fields, grant them the `View Encrypted Data` permission. You can grant the permission by editing the user's permission set.\n\nOptional: Create and set up a connected app\n-------------------------------------------\n\nSalesforce uses connected apps to integrate external applications with the\nSalesforce API, integrate service providers with your Salesforce org,\nor to control what data a third-party application can access from your Salesforce\norganization. If you prefer to use a connected app to authenticate your Salesforce\ninstance in Datastream, perform the following steps:\n\n1. Create a connected app. For more information, see the [Salesforce documentation](https://help.salesforce.com/s/articleView?id=sf.connected_app_create.htm&type=5).\n2. Configure your connected app for the [OAuth 2.0 client credentials flow](https://help.salesforce.com/s/articleView?id=sf.connected_app_client_credentials_setup.htm&type=5).\n\n | **Note:** Make sure that the user to whom you want to assign the client credentials flow has the appropriate API permissions and access to all objects and fields that you want to include in your stream. \n |\n | In Salesforce, go to **Setup \\\u003e Connected apps \\\u003e Manage connected apps** . Click the connected app for which you want to edit permissions. Under **Client credentials flow**, click the user for whom you want to edit credentials flow settings.\n3. Make sure that your connected app has the `Manage user data via APIs (api)`\n scope enabled. For more information about scopes, see\n [OAuth tokens and scopes](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_tokens_scopes.htm&type=5).\n\n4. Make sure that your connected app can access the Salesforce APIs with the\n Datastream IP addresses. For more information, see\n [Restrict access to APIs with connected apps](https://help.salesforce.com/s/articleView?id=xcloud.security_api_access_control_all_users.htm&type=5) and [Configure trusted IP ranges for a connected app](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_edit_ip_ranges.htm&type=5).\n\n5. Get the consumer key and consumer secret:\n\n 1. In Salesforce, enter `App` in the quick find box, and then select **App Manager**.\n 2. Find your connected app in the list and expand the drop-down to the right of the row.\n 3. Select **View**.\n 4. In the **Manage connected apps** details page, click **Manage consumer details**.\n 5. A screen opens asking you for a verification code. An email with the verification code is sent to the user to whom you assign the client credentials flow.\n 6. Enter the verification code. You are then redirected to the consumer details page where you can find your key and secret. You need to provide the consumer key and secret when you create your connection profile.\n\nWhat's next\n-----------\n\n- Learn more about the [Salesforce source](/datastream/docs/sources-salesforce)."]]