Connect Salesforce Agentforce
This guide is for the customer's Salesforce administrator and takes about ten minutes. Bairav never stores a consumer secret or a password: it keeps only a refresh token, encrypted, and you can disconnect (or revoke the app in Salesforce) at any time.
You need the manage_integrations permission in Bairav.
1. Create the External Client App in Salesforce
In Salesforce, open Setup, External Client App Manager, New External Client App.
| Setting | Value |
|---|---|
| Name | Bairav Governance |
| Contact email | Your admin address |
| OAuth settings | Enabled |
| Callback URL (one per line; a comma does not work) | The URL shown on Bairav's Salesforce page, Connection tab. It looks like https://your-tenant.example.com/api/salesforce/connect/callback. |
| OAuth scopes | Manage user data via APIs (api), Perform requests at any time (refresh_token), OpenID, Access chatbot services (chatbot_api), Access the Salesforce API Platform (sfap_api), Perform SQL queries on Data Cloud data (cdp_query_api) |
| Require Proof Key for Code Exchange (PKCE) | On |
| Require secret for Web Server Flow | Off (Bairav is a public PKCE client) |
| Require secret for Refresh Token Flow | Off |
| Issue JSON Web Token (JWT)-based access tokens for named users | On (the Agent API rejects opaque tokens) |
Choose the scopes when you create the app. Changing the scopes of an existing app can fail with "We couldn't update your OAuth link"; delete and recreate the app instead. Copy the Consumer Key.
2. Connect in Bairav
Open Salesforce Agentforce, Connection and enter your My Domain host (for example yourorg.my.salesforce.com, never the lightning.force.com host) and the Consumer Key. Save, then choose Connect with Salesforce, log in and approve the consent screen. You return to Bairav. Test connection shows which capabilities your org supports.
The same steps are available through the API under /api/salesforce/ (connection, connect/start, connection/test, sync).
3. What you get
- Discovery (all orgs). Agents in Agentforce Builder (drafts and published), published versions and Salesforce-managed agents appear in the Intake queue. Approve them like any other agent. Their topics, actions, findings and risk are shown on the Salesforce page.
- Lifecycle. Suspend or Block in Bairav deactivates the agent's active version in Salesforce; Reactivate restores it. This applies to published agents.
- Test conversations. They run through the Agent API and are recorded and evaluated against your Bairav policies. They run real actions in your org, so Bairav asks for an acknowledgement first.
- Session tracing. Runtime session tracing from Salesforce needs Data 360 and Einstein audit enabled in the org. Where they are not, Bairav says so with Salesforce's own message and does not simulate it.