KeySkopeAvailable · Reviewed 2026-09-18
Before you start
- A Salesforce edition with API access.
- A dedicated integration user whose effective permissions are restricted to reading the required user information.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| api OAuth scope | Enables API access; it is not a read-only restriction by itself. |
| Integration user permissions | API Enabled and only the user/profile/role read access required for the query. No Modify All Data, Manage Users or business-object write permissions. |
Connect Salesforce
- Create a dedicated External Client App and enable OAuth client credentials according to Salesforce’s current setup guide. Existing Connected Apps can continue using their supported flow.
- Enable the api scope and configure the client-credentials run-as user as the dedicated read-only integration user. Restrict app access to approved users.
- Review all effective permissions on that user, including profile and permission sets. The OAuth scope alone does not make the connection read-only.
- Copy the client ID and secret. Use your organisation’s My Domain HTTPS login URL for client credentials.
- In KeySkope, enter the login URL, client ID and secret; leave the legacy username and password fields blank.
- Run a sync and compare IsActive, Profile and UserRole for a sample user. Legacy username/password connections remain supported where the organisation allows that flow.
Connection fields
| Setting | Purpose / value |
|---|---|
| login_url | My Domain URL for client credentials; production/sandbox login host for permitted legacy flows. |
| client_id / client_secret | External Client App or existing Connected App credentials. |
| username / password / security_token | Legacy flow only; leave blank for client credentials. |
What appears in KeySkope
- User account status, available last login, Profile and UserRole. No CRM record contents are requested.
- Profile and role hierarchy are not a complete effective-permissions calculation; permission-set assignments are not collected by this version.
Verify the first sync
- Wait for the sync to finish and review its status and any partial-collection notes.
- Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
- For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
- Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.
Troubleshooting
| Setting | Purpose / value |
|---|---|
| invalid_grant | Check the flow, My Domain, run-as user and app policy. For legacy flow, check password plus security token. |
| Insufficient access | Review the exact user-query permission gap. Do not grant System Administrator or Modify All Data to resolve it. |
Official references
Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.
Ready to connect?
Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.