> For the complete documentation index, see [llms.txt](https://docs.kernel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kernel.ai/integrations/salesforce-integration.md).

# Salesforce integration

Connect Salesforce, control access, and choose where Kernel writes your data.

## What It Is

Kernel connects to Salesforce through OAuth using a dedicated integration user. Your enabled workflows and Salesforce permissions determine which objects, fields and records Kernel can read or update.

Kernel recommends writing enrichment to the Kernel Account custom object so you can review it separately from customer-owned Account fields. Your configuration can also write directly to Account, or copy selected values from Kernel Account to Account. Separate cleaning workflows can create parent Accounts, change parent relationships, merge duplicates or delete Accounts.

Use [CRM](https://docs.kernel.ai/platform/crm) to understand the data routes and [Salesforce Integration User Permission Matrix](https://docs.kernel.ai/integrations/salesforce-integration/salesforce-integration-user-permission-matrix) to review access for each workflow.

## **At a glance**

* A Salesforce admin installs the Kernel package and opens the **Kernel SF Connected App**.
* In that app, they **create an Integration User** and **authorize** Kernel via OAuth.
* Kernel stores a secure refresh token and uses short-lived access tokens for API calls.
* Kernel reads the configured source data and writes to the destinations enabled by your mappings and workflows.

***

## **Data fields**

* Kernel either (a) provides a CSV of fields to add, or (b) installs an unlocked package that adds them.
* The destination object and mapped fields determine where enrichment is written. Writing to Account or running cleaning actions can change existing CRM data. Review the configuration before enabling a workflow.

## What gets installed

* **Kernel Lightning App** with a **Kernel Setup** tab
  * `Authorize Kernel` (OAuth)
  * `Create Integration User` (one click, admin only)
  * Status panels
* **Connected App** (OAuth 2.0 Authorization Code + Refresh Token)
* **Permission Set** (baseline read + optional Kernel-field write)
* **LWC + Apex** to drive setup and status

### Data access

Use the [Salesforce Integration User Permission Matrix](https://docs.kernel.ai/integrations/salesforce-integration/salesforce-integration-user-permission-matrix) to choose access for the workflows you enable. It separates package installation and administration from ongoing integration access, including enrichment, linking, field copies and cleaning actions. Check the integration user's profile, permission sets, field access and record access together.

Lead access is needed when you enable a Lead workflow. Review the object, field and record access for each enabled workflow.

### Security model

* **Auth**: Salesforce OAuth 2.0 (Authorization Code with Refresh Token).
* **Tokens**: Refresh token is stored in Kernel’s secrets manager; access tokens are short-lived (≤ 15 min).
* **Scopes**: `api`, `refresh_token`, plus OpenID basic profile scopes for user identity.
* **IP & session**: Uses Salesforce’s standard session security. You may keep your org’s default IP restrictions.
* **Revocation**: Revoke by deactivating the Integration User or revoking the Connected App token in Salesforce. Kernel also supports revocation via the portal.

### Runtime behavior

* Reads are batched; writes (to Kernel fields) use **Bulk API 2.0** (up to 500 records/batch).
* A 100k-Account org typically consumes **< 1%** of daily API quota for nightly updates.
* Fail-safe design: Kernel retries transient API errors and surfaces status in the portal.

## FAQs

**How does Kernel authenticate?**\
Through a Salesforce Connected App using OAuth 2.0 (Authorization Code + Refresh Token). A one-time authorization under the Integration User issues a refresh token; Kernel exchanges it for short-lived access tokens.

**Who creates the Integration User?**\
An admin creates it directly **inside the Kernel Lightning App** (one click). No separate Kernel admin login is required.

**Can we restrict permissions?**\
Yes. Use the Permission Set editor in the Kernel portal to save a **custom policy per customer**. If no custom policy is saved, Kernel assigns the **default** policy.

**How do we revoke access?**\
Deactivate the Integration User or revoke the app’s token in Salesforce Setup → Connected Apps → OAuth Usage. You can also click **Revoke** in the Kernel portal.

**Is data encrypted?**\
Yes. OAuth transport uses TLS 1.2+. Secrets are stored in a secrets manager; access tokens are ephemeral.

**How do we avoid row locks during writes?**\
Kernel batches updates and can schedule sync windows (e.g., nights/weekends). Coordinate heavy internal jobs to avoid overlap.

**What’s the frequency of the Refresh Token?**\
Permanent, long-lived.

**If batched updates fail do they retry at the next interval or at a specific time?**\
Kernel automatically retries transient API failures with backoff. If a failure is not transient or continues after retries, Kernel surfaces the status in the portal for follow-up.

**Which permissions does the integration user need?**

A Salesforce administrator installs the package and configures the connection. Ongoing integration access should match the workflows you enable. Salesforce combines the user's profile, permission sets and record access, so assigning a narrower permission set does not remove access granted elsewhere. Use the [Salesforce Integration User Permission Matrix](https://docs.kernel.ai/integrations/salesforce-integration/salesforce-integration-user-permission-matrix) to review the runtime requirements.

**Where are our Kernel API keys stored in SFDC?**\
API Key is stored in your SF Database and also within Kernel.

## See also

* [Write source](/integrations/write-source.md), for choosing the connection that receives Kernel's write-back data.
* [Package installation and setup](https://docs.kernel.ai/integrations/salesforce-integration/package-installation-guide)