← All guides
Desk

Connect Salesforce to your desk

One paste and the desk works your Salesforce on its own: it reads Leads and Contacts, and writes every touch, note, owner change, and opt-out straight back, headless, with nobody logged in. Salesforce has two generations of sign-in for apps, so this guide has two paths. Both end at the same Connect card in Desk, and both take about ten minutes.

First, give the desk its own Salesforce user

Do this whichever path you take. The desk should not borrow a person's login: with its own user you control exactly what it can see, its changes are labeled in Salesforce history, and you can switch it off anytime.

  1. In Salesforce: Setup → Users → New User. Name it something honest, like desk@yourcompany.com.
  2. Give it a profile with access to Leads and Contacts (Standard User works; tighten later if you want).
  3. Finish its activation email and set its password. This is the identity you connect below.

Which path am I on?

  1. Path A, classic: your org lets apps sign in with a username and password. Most existing orgs. You paste the desk user's username, password, and security token. No app to create, nothing else to set up.
  2. Path B, newest orgs: Salesforce has retired password sign-in for apps there. The App Manager pushes you toward External Client Apps, and there is no username-password switch under OAuth and OpenID Connect Settings. You create a small app in your own org once, and the desk signs in with its key instead.

Quick test: in Setup, Quick Find, type OAuth and open OAuth and OpenID Connect Settings. If you see Allow OAuth Username-Password Flows, turn it on and take Path A. If it is not there, take Path B.

Path A: username, password, and security token

Where the security token lives: avatar menu, Settings, Reset My Security Token, then the token arrives by email
  1. Sign in as the desk user, click its avatar (top right) → Settings → Quick Find: token → Reset My Security Token → press the button. The token arrives by email, it is never shown on screen.
  2. In Setup, Quick Find: OAuth → OAuth and OpenID Connect Settings → turn ON Allow OAuth Username-Password Flows.
  3. In Desk, under Bot accounts → Connect Salesforce: paste the desk user's username, its password, and the emailed token. Leave This is a sandbox org unchecked unless this is a true sandbox copy of a paid org (a free Developer Edition is NOT a sandbox). Press Connect.

If you later change that user's password, Salesforce silently resets its security token and the connection stops. Reset the token again and reconnect, two minutes.

Path A has an expiry date. Salesforce retires password sign-in for apps in every org with its Winter '27 release. It is fine today, just know that everyone lands on Path B eventually.

Path B: the newest orgs, no password sign-in

You create one small app in your own Salesforce, tell it to run as the desk user, and paste three things into Desk: your My Domain URL, the app's consumer key, and its consumer secret. No password, no security token.

1. Create the app

App Manager: press New External Client App, then your app appears in the list, open it with View
  1. Setup → App Manager → top right, New External Client App. This is the current way: since early 2026 Salesforce blocks creating classic Connected Apps everywhere. If your org is older and still shows a working New Connected App button, that works here too, same settings.
  2. Name it (say, Ervona Desk), add your email, and enable OAuth. Callback URL: https://login.salesforce.com/services/oauth2/callback (required but never used). Scopes: add Manage user data via APIs (api). Ignore every other section, Save.

2. Turn on the Client Credentials Flow and pick the run-as user

Settings tab: check only Enable Client Credentials Flow. Policies tab: set the desk user as Run As, and relax IP restrictions
  1. On the app's Settings (or Edit) page, in the flow list, check Enable Client Credentials Flow. Only that one. Save.
  2. On the app's Policies (or Manage) page, a Client Credentials Flow section appears: set Run As to your desk user. While you are there, set IP Relaxation to Relax IP restrictions. Save.

3. Copy the consumer key and secret

Manage Consumer Details: verify by email, then copy the consumer key and the consumer secret
  1. Open the app and press the Consumer Key and Secret button on its Settings tab (on a classic Connected App: Manage Consumer Details). Enter the verification code Salesforce emails you, then copy both values. A classic Connected App can need up to ten minutes after creation before sign-ins work; External Client Apps are ready right away.

4. Copy your My Domain URL and connect

Setup, My Domain: copy the current My Domain URL
  1. Setup, Quick Find: my domain, and copy the Current My Domain URL (looks like https://yourcompany.my.salesforce.com).
  2. In Desk, under Bot accounts → Connect Salesforce: enter the desk user's username, tick My Salesforce has no password sign-in for apps (newer orgs), and paste the My Domain URL, the consumer key, and the consumer secret. Press Connect. Everything is stored write-only, never shown again.

If Connect says no

  1. "invalid_grant" or "authentication failure" on Path A: wrong password, a stale security token, the org switch (Allow OAuth Username-Password Flows) still off, or the sandbox box ticked on a non-sandbox org.
  2. "invalid_grant" or "grant type not supported" on Path B: the Client Credentials Flow box is not saved, or the Run As user is missing. Check both, save both, then try again.
  3. "That does not look like a Salesforce My Domain URL": the address is not a Salesforce web address. Paste the full https URL from Setup, My Domain. Pasting your Lightning page address is fine, we convert it.
  4. "Two-factor verification required": your Desk session needs a fresh two-factor check. Sign out of desk.ervona.ai, sign back in, and retry.
  5. Connected, but the desk sees no leads: the desk user's profile has no access to Leads or Contacts. Fix the profile, no need to reconnect.