Salesforce

Overview

This guide explains how to connect Salesforce to Forge using the Salesforce-hosted MCP server (Hosted MCP). It is intended for Salesforce administrators and Forge workspace administrators.

The Salesforce integration in Forge relies on two configuration levels:

Once connected, the Forge coach can query your CRM data (accounts, opportunities, contacts, etc.) within the scope of the signed-in user's permissions.

Important: the data visible to the coach is limited to what the connected Salesforce user can access. Forge does not bypass Salesforce permissions.

Prerequisites

On the Salesforce side

• Administrator access (or equivalent) to your Salesforce org (production or sandbox).
• The ability to create an External Client App with OAuth 2.0.
• Hosted MCP Servers enabled for your org (a Salesforce feature — see the official documentation).
• Your My Domain URL in the format https://…my.salesforce.com.

On the Forge side

• Administrator role on the relevant Forge workspace.
• Access to Settings → Integrations → Tools (or Settings → Tools).

Step 0 — Activate Hosted MCP Servers in Salesforce

Salesforce administrator. Do this first — if the MCP servers are not activated, the connection from Forge will not work, no matter how well the rest is configured.

1. In Salesforce, open Setup.
2. In the Quick Find box, type MCP Servers and select MCP Servers (under API Catalog).
3. Review the available servers and enable the ones your team needs — in particular the server Forge uses, platform/sobject-reads (read-only access to SObjects).
4. Allow up to 2 minutes for a server to become active after you enable it.

Once the servers are active, continue with Step 1. See the Salesforce guide on activating MCP servers for details.

Step 1 — Create an External Client App in Salesforce

The exact labels in Setup may vary depending on your Salesforce version. For up-to-date details, see the Salesforce documentation on Hosted MCP Servers.

1.1 Create the app

1. Sign in to Salesforce as an administrator.
2. Open Setup.
3. Create an External Client App dedicated to Forge (suggested name: Forge MCP or similar).

1.2 Configure OAuth

In the app's OAuth settings:

Options to enable (check these boxes):

• Enable Authorization Code and Credentials Flow (under Flow Enablement)
• Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows — required
• Issue JSON Web Token (JWT)-based access tokens for named users

Forge uses OAuth 2.0 with PKCE. A Consumer Secret is not required in the Forge interface for Salesforce (the flow works with the Consumer Key / Client ID only).

Important — these two options must be unchecked. Because PKCE is enabled, the app must not require a Consumer Secret. In the External Client App's OAuth settings, make sure both of the following are unchecked:

• Require secret for Web Server Flow
• Require secret for Refresh Token Flow

If either option stays checked, the OAuth connection from Forge will fail.

1.3 Collect the information

Note the following — you will need it in Step 2:

• Consumer Key (also called Client ID)
• Your org's My Domain URL, for example:
  • Production: https://your-company.my.salesforce.com
  • Sandbox / Developer: https://your-org.develop.my.salesforce.com or https://your-org--sandbox.sandbox.my.salesforce.com

My Domain URL — best practices

Callback URL

The OAuth callback URL must be registered identically in Salesforce and follows this format:

{FORGE_API_URL}/tools-oauth/salesforce-mcp/callback

Examples by Forge environment

Recommendation: copy the URL shown in Forge during Organization setup — that is the exact value to paste into Salesforce. Do not change the path, the case, or trailing slashes.

Step 2 — Organization setup in Forge

Workspace administrator only.

1. Open Settings → Integrations → Tools.
2. Find Salesforce among the available integrations.
3. Start the Organization setup (or configure the integration if it has not been done yet).
4. Copy the callback URL shown and add it to your Salesforce External Client App (Step 1).
5. Fill in:
   • My Domain URL — your Salesforce org URL
   • Consumer Key / Client ID — the key from your External Client App
6. Save.

This step does not yet connect a user: it prepares the workspace so each member can connect individually.

Step 3 — User connection

For every Forge user who wants to use Salesforce with the coach.

1. Open Settings → Integrations → Tools.
2. Click Salesforce → Connect (or edit an existing connection).
3. Name the connection if needed (e.g. "Salesforce — John").
4. Click Connect: you will be redirected to Salesforce to authorize access.
5. Accept the requested permissions.
6. Once redirected back, the connection appears as active in Forge.

Each user must complete this step with their own Salesforce account.

What the coach can do

Forge connects to the Salesforce-hosted MCP server platform/sobject-reads (read-only access to authorized SObjects).

In particular, the coach can help you:

• Find accounts, contacts, opportunities and leads
• Prepare sales meetings and follow-ups
• Track your pipeline within the scope of your Salesforce permissions

Forge signals (open opportunities, recently lost deals) are also computed from the connected user's data.

Removing the connection

1. Go to Settings > Tools.
2. Find the Salesforce connection and click Remove (trash icon).
3. Confirm in the confirmation dialog.

Implications of removal:

• The coach immediately loses access to Salesforce data and can no longer query it during conversations.
• Salesforce-related signals (open opportunities, recently lost deals) will no longer be generated.
• Ongoing conversations are not interrupted, but any request involving Salesforce will be reported as unavailable.
• Data: Forge stores no Salesforce data permanently — the integration is real-time and no copy is retained after removal. The OAuth authorization is revoked on the Forge side; you can also revoke it in Salesforce (Connected Apps OAuth Usage).
• You can reconnect Salesforce at any time by repeating step 3.

Sandbox vs production

Configure one External Client App per org (sandbox and production are separate). If you test in a sandbox first, redo the organization setup in Forge with the sandbox URL and Consumer Key.

Troubleshooting

"instanceUrl must be your Salesforce org URL…"

• Check that the URL ends with .my.salesforce.com.
• Do not use a URL copied from a Salesforce Setup page.
• Use https:// only.

OAuth error / "redirect_uri mismatch"

• The callback URL in Salesforce must match exactly the one shown in Forge.
• Check for stray spaces, extra slashes, or an http / https mismatch.

PKCE / scopes rejected

• PKCE must be enabled on the External Client App.
• The scopes mcp_api and refresh_token must be authorized.
• The options Require secret for Web Server Flow and Require secret for Refresh Token Flow must be unchecked (PKCE does not use a Consumer Secret).

The coach sees no data

• Are the Hosted MCP servers activated in Salesforce (Step 0)?
• Has the Forge user connected their own Salesforce account?
• Has the administrator completed the organization setup?
• Does the Salesforce user have read access to the relevant objects (Opportunity, Account, etc.)?

Expired connection

• Forge attempts to refresh the token automatically via refresh_token.
• If the connection appears expired, open the connection in Forge and click Reconnect.

Members can't connect

• Only a workspace administrator can perform the organization setup.
• Until that step is done, users will see a message indicating that the workspace configuration is pending.

Summary checklist

Salesforce administrator

• Hosted MCP servers activated (platform/sobject-reads)
• External Client App created
• "Enable Authorization Code and Credentials Flow" checked
• PKCE extension enabled (required)
• "Issue JSON Web Token (JWT)-based access tokens for named users" checked
• "Require secret for Web Server Flow" and "Require secret for Refresh Token Flow" unchecked
• Scopes mcp_api + refresh_token configured
• Forge callback URL registered
• Consumer Key noted
• My Domain URL identified

Forge workspace administrator

• Organization setup saved (My Domain + Consumer Key)
• Callback URL verified

End user

• Personal Salesforce connection created in Forge
• OAuth authorization accepted in Salesforce

Resources

• Salesforce documentation — Hosted MCP Servers
• Salesforce — Activate MCP Servers
• Salesforce — External Client Apps (Salesforce Setup labels)

Support

For any question about Forge configuration, contact your usual Forge representative or support through the app.

For questions about Salesforce permissions, External Client Apps, or enabling MCP in your org, contact your Salesforce administrator.