Connecting Perplexity with Salesforce

Set up the Salesforce connector with your Salesforce org’s own External Client App so Perplexity can read and update your CRM records.

This guide walks your Salesforce and Perplexity administrators through connecting a Salesforce org to Perplexity, and shows Pro, Max, Enterprise Pro, and Enterprise Max subscribers how to sign in. On Pro and Max without a Perplexity organization, you complete the Perplexity setup yourself.

Overview

The Salesforce connector lets Perplexity read and update your customer relationship management (CRM) data. It can look up accounts, contacts, leads, opportunities, and custom objects, run Salesforce Object Query Language (SOQL) queries, search records, and create, update, or delete records. The connector uses Salesforce’s hosted Model Context Protocol (MCP) server (SObject All), so every request runs as the signed-in Salesforce user, with that user’s existing permissions.

Setup has two parts:

1. Your Salesforce administrator turns on the MCP server and creates an External Client App for Perplexity in your Salesforce org. This one-time setup takes about 20 minutes, and a new app can then take up to 30 minutes to start working.

2. An administrator of your organization in Perplexity adds that app’s Consumer Key in your organization’s connector settings. This is also a one-time step. After that, each person connects their own Salesforce account. On Pro and Max, you add the Consumer Key yourself in the connector’s Manage setup tab.

Your Salesforce administrator completes the first part. Your organization’s Perplexity administrator, or you on Pro and Max, completes the second. Perplexity staff don’t need access to your Salesforce org.

The Salesforce connector is available on the Pro, Max, Enterprise Pro, and Enterprise Max plans. Your Salesforce org must be Enterprise Edition or above, or a Developer Edition org for testing.

Privacy and data security

Perplexity reaches Salesforce only as the user who connected, so Salesforce permissions are the boundary on what Perplexity can see or change.

• Access scope — Profiles, permission sets, field-level security, and sharing rules all still apply. Users can’t see or change anything through Perplexity that they couldn’t already in Salesforce.

• Audit trail — Changes made through Perplexity appear in Salesforce’s audit trail under the user’s name. MCP traffic appears in Salesforce API logs with API_CLIENT_CATEGORY = SALESFORCE_HOSTED_MCP.

• Direct connection — Perplexity connects directly to Salesforce with your Salesforce org’s own External Client App. No third-party integration service sits in between.

• Administrator control — Your Salesforce administrator can revoke all access at any time by deactivating the MCP server or blocking the External Client App. On Enterprise plans, your organization’s Perplexity administrator can also turn the connector off for the organization. Turning it off blocks the connector but keeps users’ stored sign-in tokens until each user disconnects. To remove everyone’s access at once, block the External Client App in Salesforce.

• Where data is stored — Perplexity doesn’t keep a separate copy of your Salesforce records. Results that appear in a session are saved with that session and follow your session retention settings. See Data Retention for Enterprise.

• Training use — Data accessed through the Salesforce connector is never used to train Perplexity’s models or any third-party model.

• Encryption — Connector credentials are encrypted in transit with TLS and encrypted at rest.

• Compliance — Perplexity’s controls are audited under SOC 2 Type II. Security and compliance documentation is available in the Perplexity Trust Center.

How to activate it

Before you start

• You are on the Pro, Max, Enterprise Pro, or Enterprise Max plan.

• You have a Salesforce System Administrator for the org you want to connect.

• On Enterprise plans, you have an administrator of your organization in Perplexity who can manage connector settings. On Pro and Max, you add the Consumer Key yourself.

• Your Salesforce org can use hosted MCP servers. Salesforce intends them for customers with Flex Credits and may bill server usage. Check with your Salesforce account executive. See Salesforce hosted MCP servers: Get Started and Flex Credits billable usage.

Salesforce’s hosted MCP servers accept only External Client Apps created inside your own org. Connected Apps and automatic client registration aren’t supported, so Perplexity can’t provide one shared app for every customer. See Salesforce hosted MCP servers security best practices.

Step 1: Activate the SObject All MCP server (Salesforce admin, about 2 minutes)

To try it first, test with a free Salesforce Developer Edition org before setting up production.

1. Sign in to Salesforce at login.salesforce.com or your My Domain URL, such as https://yourcompany.my.salesforce.com.

2. Click the gear icon at the top right.

3. Choose Setup.

Figure 1 — The gear menu opens Salesforce Setup.

4. In Quick Find, enter MCP Servers, then open Integrations → API Catalog → MCP Servers. All standard servers start out Inactive. The yellow banner is Salesforce’s Flex Credits billing notice.

Figure 2 — The MCP Servers list, with SObject All active and the other standard servers inactive.

5. Open SObject All.

6. Click Activate. When it’s done, the status shows Active and the button changes to Deactivate.

7. Leave every other server off.

Figure 3 — SObject All before activation, with Activate highlighted.

See Activate Standard Salesforce MCP Servers in API Catalog and the SObject All reference.

Perplexity uses SObject All rather than SObject Reads so it can create and update records. Every call still runs with the user’s own profile, field-level security, and sharing rules.

Step 2: Create the External Client App (Salesforce admin, about 10 minutes)

The tables in this step and the next mark each setting:

• Locked: required by Salesforce. Changing it requires Salesforce Support.
• Required: the connector doesn’t work without it.
• Your choice: either way works.
• Keep off: works if turned on, but adds risk.
• Test first: possible, but test it in a sandbox or Developer Edition org first.

1. In Setup Quick Find, enter External Client App Manager and open it.

2. Click New External Client App.

Figure 4 — External Client App Manager, where you create the Perplexity app.

3. Fill in Basic Information:

   Field	Value	Can you change it?
   External Client App Name	Perplexity	Your choice
   API Name	Perplexity	Your choice
   Contact Email	An IT distribution list	Your choice
   Distribution State	Local	Required
   Info URL	https://www.perplexity.ai (optional)	Your choice
   Description	Lets Perplexity run Salesforce hosted MCP tools on behalf of signed-in users.	Your choice

   Table 1 — Basic Information settings for the Perplexity External Client App.

Figure 5 — Basic Information for the Perplexity External Client App.

4. Expand API (Enable OAuth Settings) and select Enable OAuth.

5. Paste both of these URLs into Callback URL (required), one per line, exactly as written. A mismatch makes sign-in fail with redirect_uri_mismatch.

   https://www.perplexity.ai/rest/connections/oauth_callback
   https://enterprise.perplexity.ai/rest/connections/oauth_callback
   

6. Move exactly two scopes to Selected OAuth Scopes under OAuth Scopes (required):

   • Access Salesforce hosted MCP servers (mcp_api)
   • Perform requests at any time (refresh_token, offline_access)

   Leave Introspect all Tokens and Configure ID token cleared. You’ll use the Consumer Key and Secret button shown here in Step 4.

Figure 6 — OAuth settings with both callback URLs and the two required scopes.

7. Set Flow Enablement and Security:

   Setting	Value	Why	Can you change it?
   Flow Enablement (all 5 options)	Off	The connector doesn’t use these. Turning them on only opens more ways in.	Keep off
   Require secret for Web Server Flow	Off	Perplexity uses a public client with PKCE. If you turn this on, share the Consumer Secret along with the key. Perplexity’s setup form accepts it.	Your choice
   Require secret for Refresh Token Flow	Off	Same as above.	Your choice
   Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows	On	Required by Salesforce. Changing it requires Salesforce Support.	Locked
   Enable Refresh Token Rotation	On	Required by Salesforce. Changing it requires Salesforce Support.	Locked
   Issue JSON Web Token (JWT)-based access tokens for named users	On	Without it, sign-in works but every MCP call returns 401.	Required
   Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days	On	Required by Salesforce. Changing it requires Salesforce Support.	Locked
   Enforce Refresh Token IP Allowlist	Off	Token refreshes come from Perplexity’s servers, not your users’ networks, so an allowlist can block them.	Keep off

   Table 2 — Flow Enablement and Security settings for the Perplexity External Client App.

Figure 7 — Flow Enablement and Security settings for the Perplexity app.

8. Leave SAML, Canvas, Mobile, and Push Notification settings off, then click Create.

Figure 8 — SAML, Canvas, Mobile, and Push Notification settings left off.

See Create an External Client App for hosted MCP servers and Configure External Client App OAuth settings.

Step 3: Set policies (Salesforce admin, about 3 minutes)

Open the app, go to Policies, and click Edit.

Setting	Recommended	Why	Can you change it?
Permitted Users	All users can self-authorize	Each person signs in as themselves, so Salesforce permissions still apply. To restrict access, select Admin approved users are pre-authorized and assign a permission set.	Your choice
IP Relaxation	Relax IP restrictions, if any profile has login IP ranges	Without login IP ranges, Enforce IP restrictions also works.	Your choice
Refresh Token Policy	Your decision, for example expire if unused for 30 days	30 days or less, with rotation.	Your choice
Named User JWT token timeout	Use the user’s default session timeout	Salesforce default.	Your choice
Start Page	None	Salesforce default.	Your choice
Single Logout	Off	You can turn it on later to cut off sessions as soon as someone leaves.	Your choice
High Assurance Session Required	Off	It may force an extra login check, such as multi-factor authentication (MFA), that Scheduled Tasks can’t pass.	Test first

Table 3 — Recommended policy settings for the Perplexity External Client App.

Salesforce recommends a refresh token policy of 30 days or less with rotation. A shorter limit means people who use Scheduled Tasks reconnect more often. Don’t choose Immediately expire refresh token, because Scheduled Tasks would fail.

Figure 9 — App Authorization policy settings.

Figure 10 — Permitted Users options for the Perplexity app.

Click Save when you’re done.

See Manage External Client Apps, Refresh token rotation, and Salesforce hosted MCP servers security best practices.

Step 4: Share the Consumer Key (Salesforce admin, about 2 minutes)

1. In the app, open Settings → OAuth Settings → Consumer Key and Secret (shown in Step 2.6). Salesforce emails you a verification code.

2. Copy the Consumer Key. If you turned on Require secret for Web Server Flow or Require secret for Refresh Token Flow in Step 2.7, also copy the Consumer Secret.

3. On Enterprise plans, send the key, and the secret if you copied it, to your organization’s Perplexity administrator through your password manager or another approved secrets channel. On Pro or Max without a Perplexity organization, send them the same way to the person who completes Step 5, or keep them in your password manager if that’s you.

Never send the Consumer Key or Consumer Secret in plain chat or email.

A new External Client App can take up to 30 minutes to start working. Until then, sign-in fails with invalid_client_id.

Step 5: Add the Consumer Key to Perplexity (Enterprise: your Perplexity organization admin, about 5 minutes)

These settings apply only to your organization. Other organizations use their own External Client App and their own settings.

1. In Perplexity, open Organization settings → Connectors.

2. Search for Salesforce.

3. Select the connector whose description starts with “Query, search, create, and update Salesforce CRM records.” If you don’t see it, the new Salesforce connector isn’t available for your organization yet.

4. Click Manage setup. If you don’t see the button, open the row’s More options menu and choose Manage setup.

5. Choose Use custom organization setup. If Setup method appears, select Enter credentials manually.

6. Paste the Consumer Key. Leave the Consumer Secret blank unless you turned on a secret requirement in Step 2.7.

Figure 11 — The Salesforce setup form in Perplexity.

7. Optional: if your Salesforce org uses single sign-on, enter your My Domain URLs so users go straight to your company’s sign-in page instead of clicking Use Custom Domain:

   • Authorization Endpoint: https://yourcompany.my.salesforce.com/services/oauth2/authorize

   • Token Endpoint: https://yourcompany.my.salesforce.com/services/oauth2/token

   • Revocation Endpoint: https://yourcompany.my.salesforce.com/services/oauth2/revoke

   Replace yourcompany with your My Domain name. You can find it in Salesforce Setup under My Domain. Leave these fields blank to use login.salesforce.com.

8. Click Save setup, then click Continue to confirm.

You can also open the Salesforce connector and click Open connector settings on the Organization setup required card to reach the same setup.

You can change the Consumer Key or My Domain URLs later from Manage setup. Changing the setup disconnects members who already connected, so they need to reconnect afterward.

Step 5 (without a Perplexity organization): Add the Consumer Key yourself (about 5 minutes)

If you’re on Pro or Max and not part of a Perplexity organization, you add your own External Client App’s Consumer Key. You still need a Salesforce System Administrator to complete Steps 1 to 4. If you don’t have a company Salesforce org, you can sign up for a free Salesforce Developer Edition org. You’re its System Administrator, so you can complete Steps 1 to 4 yourself.

1. Open the Salesforce connector. The connector shows Personal setup required.

2. Open the Manage setup tab and choose Use custom setup. If Setup method appears, select Enter credentials manually.

3. Paste the Consumer Key. Leave the Consumer Secret blank unless you turned on a secret requirement in Step 2.7. Optionally add your My Domain URLs, as described in Step 5.7.

4. Click Save setup, then click Continue to confirm. Then continue with Step 6.

This setup applies only to you.

Step 6: Connect your account (each user)

1. Open the Salesforce connector in Perplexity and click Add connector (or Connect).

2. Sign in to Salesforce and approve access. If My Domain URLs were added in Step 5, you go straight to your company’s sign-in page. Otherwise, if your company uses single sign-on, click Use Custom Domain on the Salesforce sign-in page, enter your company’s domain, such as yourcompany, and sign in. See Use the correct login URL.

Figure 12 — Salesforce asks you to allow access the first time you connect.

How to verify it worked

1. In a new session, ask: “Using Salesforce, who am I logged in as?” Perplexity should reply with your name and role in Salesforce.

2. Ask: “List my 5 most recently viewed accounts.”

3. Optional: ask Perplexity to create a test Salesforce Task record, then delete it, and check that Salesforce’s audit trail shows your name. A Read Only user’s write attempt should fail with INSUFFICIENT_ACCESS_OR_READONLY.

See Salesforce’s Test MCP clients guidance.

Trying it out

• “Show my open opportunities closing this quarter, sorted by amount.”

• “Update the stage on the Globex opportunity to Negotiation.”

• “Every Monday, summarize opportunities that changed stage last week.”

Permissions and scopes

Item	Purpose
mcp_api scope	Lets Perplexity call Salesforce’s hosted MCP server
refresh_token scope	Keeps users connected between sessions. Your refresh token policy decides how long this lasts.
Salesforce profile and sharing rules	The access boundary. A read-only user can read but not write.

Table 4 — What Perplexity requests and what limits it.

Available actions: get object schema, SOQL query, search (Salesforce Object Search Language, SOSL), get user info, list recent records, get related records, create a record, update a record or related record, and delete a record or related record. See the SObject All reference.

Not supported: bulk or batch updates, file and attachment uploads, converting leads, sending email, and running reports. These aren’t available on Salesforce’s standard hosted MCP servers.

Troubleshooting

Symptom	Likely cause	Fix
The Salesforce connector doesn’t appear	Your organization’s Perplexity administrator turned it off, or it isn’t available for your organization or plan yet	Ask your organization’s Perplexity administrator, and check the plans listed in Overview
Organization setup required	No one has saved a Consumer Key in Perplexity yet	Ask your organization’s Perplexity administrator to complete Step 5
Personal setup required	You’re on Pro or Max without a Perplexity organization, and you haven’t saved a Consumer Key yet	Complete Step 5 (without a Perplexity organization)
redirect_uri_mismatch	A callback URL is missing or mistyped	Re-check Step 2.5. The URLs must match exactly.
invalid_client_id	Wrong Consumer Key, or the app is less than 30 minutes old	Copy the key again, or wait and retry
Sign-in works, but requests fail with 401	SObject All isn’t active, JWT-based tokens aren’t enabled, or the mcp_api scope is missing	Re-check Steps 1, 2.6, and 2.7
The sign-in page requires your company’s domain, or SSO doesn’t appear	Your Salesforce org blocks logins through login.salesforce.com	Add My Domain URLs in Step 5, or click Use Custom Domain and enter your domain
OAUTH_APP_ACCESS_DENIED	Permitted Users blocks this user	Change Permitted Users, or assign the permission set
INSUFFICIENT_ACCESS_OR_READONLY	The user’s Salesforce profile doesn’t allow the action	This is expected. Adjust Salesforce permissions if needed.
Users are asked to reconnect periodically	The refresh token expired or hit its idle timeout	Review the refresh token policy on the External Client App
The connector shows Add connector (or Connect) again	The setup changed, or access was revoked in Salesforce	Click Add connector (or Connect) in the Salesforce connector and sign in again
Results look out of date	The connector reads live Salesforce data on every request	Check the record in Salesforce. If it differs, ask again in a new session.

Table 5 — Common Salesforce connector errors.

Frequently asked questions

What data does the connector access?

Only what the signed-in user can already access in Salesforce, through the actions listed in Permissions and scopes. Profiles, permission sets, field-level security, and sharing rules all still apply.

Can Perplexity write to Salesforce?

Yes, if the user’s Salesforce permissions allow it. To limit this, give users a narrower permission set or profile.

Can my administrator restrict who uses this connector?

Yes, on both sides. In Salesforce, use Permitted Users with a permission set. On Enterprise plans, your organization’s Perplexity administrator can turn the connector off for the organization. Users’ stored sign-in tokens are kept until each user disconnects, so to remove everyone’s access at once, block the External Client App in Salesforce. To see who has connected or to revoke tokens, use Manage External Client App OAuth Usage.

How long is data kept after I disconnect or the connector is turned off?

When you disconnect, Perplexity deletes your stored Salesforce sign-in tokens. If your organization’s Perplexity administrator turns the connector off, users’ tokens are kept until each user disconnects. To remove everyone’s access at once, your Salesforce administrator can block the External Client App. Sessions that include Salesforce results follow your session retention settings. See Data Retention for Enterprise.

I used the earlier Salesforce connector. What changes?

You’ll be asked to reconnect once, after the Consumer Key is added in Step 5, either by your organization’s Perplexity administrator or, on Pro or Max without an organization, by you. Your existing connection can’t move over automatically, because the new connector uses your Salesforce org’s own app.

Will my Salesforce data be used to train AI models?

No. Data accessed through the Salesforce connector is never used to train Perplexity’s models or any third-party model.

Is this connector available on my plan?

Yes, on the Pro, Max, Enterprise Pro, and Enterprise Max plans. Your Salesforce org must be Enterprise Edition or above, or a Developer Edition org for testing.

Related articles

• Perplexity Connectors for Enterprise: FAQ

• Role-based access control for connectors

• Enterprise Connector Troubleshooting Guide

• Connecting Perplexity with Snowflake

Need more help?

When you write in, include the connector name, the exact error message, the time it occurred, and the steps from this article that did not resolve it.

Reach out to your account team or contact us via Help > Contact Support. Visit the Trust Center for security and compliance documentation.