Salesforce holds your pipeline: which deals are open, what stage they are in, and where your leads came from. Contextflo connects it to Claude and ChatGPT so you can ask about opportunities, accounts and cases in plain English, next to the data in Stripe and your warehouse.
How it connects
Salesforce connects through OAuth 2.0 with the client credentials flow. You create an External Client App (or a connected app) in Salesforce, enable the client credentials flow, and pick a run-as user. Contextflo uses the app's consumer key and secret to get an access token for that user.
Contextflo sends only read requests to the Salesforce REST API, and the query tool rejects anything that is not a SOQL SELECT.
What's covered
| Endpoint | What you get | Filters |
|---|---|---|
| SOQL query | Any SELECT the run-as user can run, with relationships, GROUP BY and date literals like THIS_MONTH, paged through automatically | Anything SOQL supports |
| Describe object | Every field on a standard or custom object: API name, label, type, lookup target, active picklist values | Object name |
| Accounts | Name, type, industry, website, billing country, annual revenue, employees, owner | Created and last modified date |
| Contacts | Name, email, title, account, lead source, mailing country, owner | Created and last modified date |
| Leads | Name, email, company, status, lead source, conversion date and the converted account, contact and opportunity | Created and last modified date |
| Opportunities | Name, account, stage, amount, probability, close date, won or lost, forecast category, owner | Created and last modified date |
| Cases | Case number, subject, status, priority, origin, account, contact, closed date | Created and last modified date |
Accounts, contacts, leads, opportunities and cases each have a list endpoint and a get-by-id endpoint. For anything else, including custom objects, Claude describes the object and writes the SOQL.
Permissions
Two layers:
- The run-as user. Salesforce applies that user's profile, permission sets, field-level security and sharing rules to every call. Give it read access to the objects you want covered and nothing more. That is the ceiling: nothing in Contextflo can go past it.
- Groups in Contextflo. Admins allow or deny each Salesforce endpoint per group. Sales can query opportunities while support only sees cases, for example.
Freshness
There is no sync. Every question calls the Salesforce API when you ask it, so a deal moved to Closed Won five minutes ago shows up in the answer. Nothing is copied into a table, and there is no schedule to wait for.
Set it up
- Create a read-only run-as user. In Salesforce Setup, create a user with the Salesforce Integration license and the Minimum Access - API Only Integrations profile. Assign a permission set that grants Read on Accounts, Contacts, Leads, Opportunities, Cases and any custom objects you want covered.
- Create an External Client App. In Setup, open External Client App Manager and click New External Client App. Enable OAuth, add the Manage user data via APIs (api) scope, and check Enable Client Credentials Flow. If your org still uses connected apps, the same settings are under App Manager > New Connected App.
- Set the run-as user. In the app's policies, enable the client credentials flow and set Run As to the user from step 1.
- Copy the credentials. Copy the Consumer Key and Consumer Secret from the app's OAuth settings, and your My Domain URL (it looks like
https://yourcompany.my.salesforce.com) from Setup > My Domain. - Paste them in Contextflo. Go to Settings > Data sources, add Salesforce, and paste the consumer key, consumer secret and My Domain URL. You need to be an admin.
- Set group access. Allow or deny the Salesforce endpoints for each group.
- Connect your AI tool. If Claude or ChatGPT isn't talking to Contextflo yet, add the connector: Claude or ChatGPT. Then ask your first question.
FAQ
Can Contextflo change anything in our Salesforce org?
No. Contextflo only sends read requests and only runs SOQL SELECT queries. It cannot create, edit or delete records, even if the run-as user could.
What data can Claude see?
Only what the run-as user on your connected app can see. Salesforce applies that user's object permissions, field-level security and sharing rules to every request, so a field hidden from the user is hidden from Claude too.
Do you copy our Salesforce data into a warehouse?
No. Every question calls the Salesforce API at that moment and nothing is synced or stored as a table. The answer reflects your org as of the question.
Does it work with custom objects and fields?
Yes. Claude can look up the fields of any object the run-as user can read, including custom ones ending in __c, and then query them with SOQL.
Does it use our Salesforce API limits?
Yes. Each question makes a few API calls, which count toward your org's daily API request allocation like any other integration. A typical question uses a handful of requests.
Can I join Salesforce data with Stripe or my warehouse?
Claude or ChatGPT can pull opportunities from Salesforce and then look up Stripe or run a query on your warehouse in the same conversation, matching on account name, email or an id you store on both sides. It is lookups side by side, not a single SQL join.