Creating a scoped-down Salesforce account

The Conveyor Salesforce integration uses OAuth to grant authorization for Conveyor's Salesforce Connected App. We then use that authorization to fetch your Salesforce data.

Whichever account you use to authenticate, Conveyor will get the permissions on that account when fetching your Salesforce data. That means if, for example, you authenticate using your Salesforce admin's account, Conveyor will likely get permissions to fetch more Salesforce data than we need. If that does not pose an issue for your organization, then authenticating Conveyor using your Salesforce admin's account is the quickest way to complete setup.

However, if scoping down to the minimum permissions is important to your organization, we recommend creating a new user that has only the minimum permissions Conveyor needs to make this integration work.

Creating a scoped-down Salesforce user to integrate with Conveyor

In order to create a user with the minimum permissions required for the Conveyor integration to work, you need to:

1. Create a new Salesforce profile;
2. Grant access to Conveyor's required objects;
3. Check the Field-Level Security for each of Conveyor's required fields; and,
4. Create a new user with the new profile assigned.

Note: Examples here will be given in the Salesforce Classic experience, and not the Lightning Experience.

Create a new Salesforce profile

1. Go to "Setup"
2. In the left panel's quick search input, type "Profiles"
3. Click on the search result "Profiles" under "Manage Users"

4. On the "Profiles" page, click the button "New Profile"
5. Choose an existing profile to clone from. If you pick a profile that already has very minimal permissions, it will be easier to modify it to what Conveyor needs (e.g. Salesforce has a default profile called "Minimum Access - Salesforce" on the "Salesforce" user license)
6. Enter a "Profile Name" - something like "Conveyor Integration" would suffice

Grant access to Conveyor's required objects

1. After you have cloned a profile, you need to click "Edit"
2. You need to uncheck everything except the following:

• "API Enabled" under "System Permissions"
• "Edit Events" under "System Permissions"
• "Accounts", "Contacts", "Leads", and "Opportunities" under "Standard Object Permissions"
  • If you plan on sending events and completed questionnaires to Salesforce, you need to check "Edit" for the objects that you want to create events / attachments on (e.g. Account). Otherwise, just checking "View All" will suffice

3. Set whatever your organization's policies dictate for "Session Settings" and "Password Policies"
4. Click "Save"

Check the Field-Level Security for each of Conveyor's required fields

Unfortunately, just granting View All / Read access to the object might not cover everything. We need to check that the specific fields Conveyor needs are allowed. To do this, we need to check the profile's Field-Level Security.

1. From your new "Conveyor Integration" profile's view page, scroll down to the section called "Field-Level Security"

2. For each of the objects you need to grant permissions for (e.g. "Account", "Contact", "Lead", "Opportunity"), do the following:

• Click "View" beside the object name
• Click "Edit" at the top
• Ensure each of the below fields are checked for the listed Access
• Click "Save"

Here's a list of the permissions required for the ROI dashboard, which is the minimum set of required permissions.

Depending on what Conveyor Salesforce integration features you turn on, you may need more permissions. You can always check what permissions you need vs. what you have already configured by going here and clicking on "Permissions Check".

When you see all green checkmarks, you are all set to go!

Note: For any object that you have to "Edit" (e.g. Lead), make sure to check your "Validation Rules" for the object to see if anything is required. E.g. Sometimes Lead Source is required. If so, make sure you fill in that value in Conveyor.

Create a new user

1. In the left panel's quick search input, type "Users"
2. Click on the search result "Users" under "Manage Users"
3. Click "New User"

4. Enter the details you would like for the service account user
5. Make sure that the "Profile" is set to the one you created for Conveyor. Note that the "User License" determines which profiles can be selected. Check the profile you created to see which user license it falls under.
6. Click "Save"

That's it! You now have a user with the minimum permissions that Conveyor needs, and no more.

Using the Salesforce Integration License

Starting in September 2025, Salesforce introduced new restrictions on “uninstalled connected apps.” These changes affect OAuth-based integrations like Conveyor.

Important limitation of the Salesforce Integration license

The Salesforce Integration user license cannot be granted the following permissions:

• Approve Uninstalled Connected Apps
• Use Any API Client

As a result, a Salesforce Integration user cannot perform the initial authorization/install flow for Conveyor if the Conveyor connected app has not already been installed into the org.

If you attempt to connect Conveyor before the app is installed, Salesforce may display errors such as:

• app must be installed into org
• OAUTH_APPROVAL_ERROR_GENERIC

Recommended setup flow

To use Conveyor with a Salesforce Integration user:

1. First, authenticate Conveyor using a full Salesforce user (typically a System Administrator).
2. After the Conveyor app appears in:
   • Setup → Connected Apps OAuth Usage
3. Click Install next to the Conveyor connected app.
4. Once installed, reconnect using the Salesforce Integration user.

After the app is installed, the Salesforce Integration user can continue using the integration normally without requiring elevated permissions.

Why this happens

Salesforce now blocks most users from authorizing uninstalled connected apps as part of a broader security initiative to prevent OAuth phishing and social-engineering attacks.

Using non-Integration Licenses

If you are using a standard Salesforce user license (for example, Salesforce or Salesforce Platform) instead of the Salesforce Integration license, you can grant the Approve Uninstalled Connected Apps permission to allow trusted users to authorize Conveyor before the app is installed. The Approve Uninstalled Connected Apps permission only allows a trusted user to authorize the app before it has been installed into the org. Installing the connected app is still recommended so that future authentications can proceed normally without requiring elevated permissions.

Create a permission set

1. In Salesforce, go to:
   • Setup → Permission Sets
2. Click New
3. Create a permission set such as:
   • Connected App Installer

Enable the permission

1. Open the permission set
2. Go to:
   • System Permissions
3. Click Edit
4. Enable:
   • Approve Uninstalled Connected Apps
5. Save

If your org has API Access Control enabled, Salesforce may instead require the Use Any API Client permission.

Assign the permission set

1. Open the permission set
2. Click:
   • Manage Assignments
3. Assign it to the user who will perform the initial Conveyor authorization

Install the Conveyor connected app

1. Start the Conveyor Salesforce connection flow
2. Complete OAuth authorization
3. In Salesforce, go to:
   • Setup → Connected Apps OAuth Usage
4. Find the Conveyor connected app
5. Click Install

Once installed, your integration user no longer needs the Approve Uninstalled Connected Apps permission to use Conveyor.

Next step

Return to the Salesforce documentation to finish setting up your Salesforce account.