Salesforce Agentforce

Airia connects to your Salesforce org and discovers Agentforce agents (Salesforce BotDefinition records), including name, developer name, description, type, and last modified date.

Authentication model

OAuth 2.0 client credentials flow against your Salesforce org: a connected app's consumer key and secret, plus your instance URL. Airia exchanges the credentials for a token and reads agents through the standard query API.

Required Salesforce-side configuration

1. A connected app or External Client App with the client credentials flow enabled, and a designated run-as user (Salesforce requires an execution user for this flow). Either app type works; newer orgs steer you to External Client Apps by default.
2. The run-as user needs:
   • API Enabled permission
   • Read access to bot/agent metadata (BotDefinition): the "View Setup and Configuration" permission or an equivalent permission set that exposes agent records to the API
3. Agentforce (or Einstein Bots) must be provisioned in the org. In an org where no agent has ever been set up, the BotDefinition object is not exposed to the API; the Airia connection then authenticates successfully but reports a warning on the agent query and discovers nothing. This is expected on empty orgs.

Use a dedicated integration user with a minimal permission set rather than an admin.

Three details that commonly trip up setup:

• Run As takes the Salesforce username, not the login email. These often differ (usernames look like name.xxxx@yourdomain...); find yours under Setup → Users → Users, in the Username column. Entering an email that is not a valid username fails with "Enter a valid execution user."
• If the token call returns invalid_grant: no client credentials user enabled, the run-as user did not save; re-edit the app's policies and set it again.
• Set the app's IP Relaxation to "Relax IP restrictions" (or add Airia's egress addresses to trusted ranges); with enforcement on, the token calls from Airia's cloud can be rejected.

Customer-side setup steps

1. In Salesforce Setup → App Manager → New Connected App: enable OAuth settings, enable the Client Credentials Flow, and assign the run-as integration user.
2. Copy the connected app's Consumer Key (client ID) and Consumer Secret.
3. Copy your instance URL (for example https://yourcompany.my.salesforce.com).
4. In Airia, go to Discover → Connections → Salesforce Agentforce and create a new connection.

Form fields the Airia UI asks for

Connection test checks

The connection test validates configuration, authentication (the token exchange), and agent query access in order. A token-endpoint failure means the connected app or flow settings are wrong; a query failure after successful authentication means the run-as user lacks read access to agent metadata.

Multiple environments

Multiple Salesforce Agentforce connections per tenant are supported: one per org (for example, production and a sandbox).