Salesforce Setup & Permissions

This guide covers the complete setup process for connecting Stood Flows to your Salesforce org, including OAuth configuration, required permissions, and security best practices.

OAuth Configuration

Create a Connected App in your Salesforce ORG

1. Navigate to Setup:

   • Go to Setup → App Manager → New Connected App (or edit existing)

2. Configure OAuth Settings:

   • Callback URL: https://stoodflows.web.app/salesforce-oauth-callback

   • Selected OAuth Scopes:

     • api - Access to Salesforce REST API

     • refresh_token - Ability to refresh access tokens

     • offline_access - Long-lived session support

   • Require Proof Key for Code Exchange (PKCE): Unchecked (must be disabled)

3. Save Configuration:

   • Keep your Client ID and Client Secret for your Stood setup

   • Save the Connected App configuration

Required Permissions

💡 Best Practice: Permissions are applied on top of OAuth settings that simply open the door for the authenticated user. You may use an integration tech user for this or consider plugging your sandbox only (full sandbox preferred to have representative statistics on data).

OAuth Scopes

The application requires the following OAuth scopes (or "full access"):

• api - Access to Salesforce REST API

• refresh_token - Ability to refresh access tokens

• offline_access - Long-lived session support

User Permissions Required

Standard API Access

• Read access to Lead, Opportunity, and Case objects

• Read access to RecordType, BusinessProcess, OpportunityStage, CaseStatus objects

• Ability to execute queries on standard objects

• Field History Tracking access (for Lead Status, Cases and Opportunity Stage fields)

Tooling API Access

• Read access to Tooling API objects:

  • FlowDefinition - Flow definitions

  • Flow - Flow metadata

  • ApexTrigger - Apex trigger definitions

  • Layout - Layout definitions

  • ProfileLayout - Profile-layout associations

  • Profile - Profile metadata

  • BusinessProcess - Business process metadata

Describe Access

• Ability to describe Lead, Opportunity, and Case objects (for field and relationship metadata)

• Standard object describe permissions

Profile Metadata Access

• Read access to Profile metadata

• Access to Record Type visibility settings in Profile metadata

License Data Access (Optional)

• Read access to UserLicense (may not be available in Developer/Sandbox editions)

• Read access to PermissionSetLicense

• Read access to User object (for license analysis)

Limits API Access

• Access to Limits API (for organization limits and usage tracking)

Recommended Permission Sets

Minimum Required

1. API Enabled - Required for all API access

2. Read access to Lead, Opportunity, and Case objects

3. Read access to RecordType, BusinessProcess, OpportunityStage, CaseStatus objects

4. Tooling API access enabled

5. Read access to FlowDefinition, Flow, ApexTrigger, Layout, ProfileLayout, Profile in Tooling API

Recommended (for Full Functionality)

1. API Enabled - Required for all API access

2. View All Data (optional) - For accessing all records regardless of sharing rules

3. Customize Application - For accessing metadata objects

4. View Setup and Configuration - For accessing Tooling API objects

5. View Field History - For lifecycle analytics (requires Field History Tracking enabled)

Field History Tracking Setup

For lifecycle analytics to work, you must enable Field History Tracking on:

Lead Object

• Status field - Track status changes for lifecycle analysis

Opportunity Object

• StageName field - Track stage changes for lifecycle analysis

Setup Steps

1. Go to Setup → Object Manager → Lead (or Opportunity)

2. Click Fields & Relationships

3. Find the Status (Lead) or StageName (Opportunity) field

4. Click Set History Tracking

5. Enable history tracking for the field

6. Save

⚠️ Note: Field History Tracking has data retention limits (typically 18-24 months). Historical data beyond this period will not be available for analysis.

Security Best Practices

Integration User

Recommended: Create a dedicated integration user with minimal permissions:

1. Create Integration User:

   • Create a user specifically for Stood Flows integration

   • Use a descriptive name (e.g., "Stood Flows Integration User")

   • Set to inactive login hours if desired

2. Assign Permission Set:

   • Create a permission set with only required permissions

   • Assign to integration user

   • Review and update regularly

3. Monitor Usage:

   • Review login history regularly

   • Monitor API usage

   • Set up alerts for unusual activity

Sandbox vs Production

Recommended Approach:

• Development/Testing: Use a Full Sandbox (preferred)

• Production: Use integration user with minimal permissions

• Full Sandbox Benefits:

  • Representative data volumes

  • Realistic record counts

  • Safe testing environment

  • No impact on production users

Data Access Considerations

• Read-Only Operations: Stood Flows is currently read-only - no modifications to your org

• Data Isolation: All data is isolated by organization in Stood Flows

• Token Security: OAuth tokens stored securely with organization-based access control

• API Rate Limits: Application includes progress tracking and respects Salesforce rate limits

API Rate Limits

Standard API

• Default: 15,000 API calls per 24 hours (per org)

• Usage: Standard object queries (Lead, Opportunity, Case, RecordType, etc.)

Tooling API

• Default: 5,000 API calls per 24 hours (per org)

• Usage: Metadata objects (FlowDefinition, Flow, ApexTrigger, Layout, ProfileLayout, Profile)

Optimization

The application minimizes API usage through:

• Versioned Snapshots: All metadata stored in versioned snapshots

• Incremental Refresh: Only fetches new data when refreshing

• Caching: Uses stored versions for display

• Progress Tracking: Shows API usage during refresh operations

Troubleshooting

Common Issues

"Insufficient Access Rights"

• Solution: Ensure user has required permissions listed above

• Check: Permission sets and profiles assigned to user

"Field History Tracking not enabled"

• Cause: Field History Tracking not enabled for Status/StageName fields

• Solution: Enable Field History Tracking (see setup steps above)

• Note: Lifecycle analytics will not work without this

"PKCE Required"

• Cause: Connected App has PKCE enabled

• Solution: Disable PKCE in Connected App settings

"Invalid Callback URL"

• Cause: Callback URL mismatch

• Solution: Ensure callback URL is exactly: https://stoodflows.web.app/salesforce-oauth-callback

Support

For setup assistance and commercial questions, contact: contact@stoodcrm.com