# Connect Salesforce

> Import contact records so an audience is built from your real customers. An admin creates a read-only External Client App once, inside your own org.

Source: https://imario.ai/docs/audiences/connections/connect-salesforce

Salesforce says who your customers are. Importing their contact fields is what makes an audience your customers rather than a plausible group.

Salesforce stopped allowing new Connected Apps on every org in Spring '26, so an integration registered today is an **External Client App**. There is no shared iMario app to authorize: an admin in your own org creates a local one, and iMario uses it to read only the fields you pick.

## What your admin does, once

1. In Salesforce, open **Setup** → search **External Client App Manager** → **New External Client App**.
2. Enter a name your colleagues will recognise, such as "iMario", and a contact email.
3. Set **Distribution State** to **Local**. The app stays inside your org and cannot be installed anywhere else.
4. Under **API (Enable OAuth Settings)**, tick **Enable OAuth** and set the **Callback URL** to exactly:

   ```
   https://api.imario.ai/api/connections/callback
   ```

5. For **OAuth Scopes**, add these two and nothing else:

   | Scope | What it lets iMario read |
   | --- | --- |
   | Manage user data via APIs (`api`) | Contact records and the fields you pick |
   | Perform requests at any time (`refresh_token, offline_access`) | So an import that takes a while does not die halfway |

   Do not grant **Full access (`full`)**. iMario does not need it and will not use it.

6. Leave **Require Proof Key for Code Exchange (PKCE)** ticked. iMario sends the PKCE challenge, so the default is correct and you do not need to weaken it.
7. Click **Create**. Then reopen the app, go to the **Policies** tab, edit it, and set the refresh token policy to **Refresh token is valid until revoked**.
8. On the **Settings** tab, open **Consumer Key and Secret** and copy both.

## Connect in iMario

1. In **Create audience**, click **Connect a data system** and choose **Salesforce**.
2. Paste the **Consumer Key** and **Consumer Secret** from step 8.
3. If your org uses a My Domain host, enter it (for example `acme.my.salesforce.com`). Leave it blank to sign in through `login.salesforce.com`.
4. Click **Connect to Salesforce** and approve on Salesforce's own page.
5. Your contact fields are listed with how complete each one is, counted from a sample of real contacts. Tick the ones that describe your customers.
6. Click **Import**.

## What iMario reads

Contact records, and only the fields you tick. Each record carries its Salesforce id as a join key and its email address as a cross-system alias. That is what lets a survey answer or an interview reach the same person. Neither is treated as an answer or as a demographic.

iMario reads no opportunities, no cases, no activity history. It never writes to Salesforce.

Only fields that genuinely correspond to a demographic dimension are renamed on the way in; anything else keeps its own name, and you confirm the mapping before the audience is built.

## Troubleshooting

**"redirect_uri_mismatch".** The Callback URL is compared character for character. Check for a trailing slash, and that it is the address in step 4.

**The import returns no records.** The connected user can only see what their profile allows. Check that the user who authorized has read access to Contacts and to the fields you ticked.

**Everything imports but the fields are empty.** Field-level security is hiding them from the connecting user's profile. Salesforce returns the record without the field rather than an error.

## Next steps

- [Connect a data system](https://imario.ai/docs/audiences/connections/connect-data-system): How every connected system is imported and disconnected.
- [Build an Audience from Your Data](https://imario.ai/docs/audiences/build-from-data): Turn the imported records into a reusable audience.