Skip to content
threada Docs

Salesforce setup and support

Threada for Salesforce is the planned Salesforce AppExchange integration for turning governed Threada work into reviewable Salesforce CRM Contact operations. The first reviewable package is intentionally narrow: it supports an AppExchange API listing path, External Client App or approved Connected App OAuth, Salesforce org mapping, setup-required feedback, governed Contact create or update proposals, and safe links back to Threada. It does not perform unmanaged Salesforce writes, update opportunities, package Lightning UI, create Flow actions, package Apex, write metadata, subscribe to Platform Events or webhooks, request file/user/admin/analytics/Data Cloud scopes, or act as a generic Salesforce AI agent.

This guide supports private Salesforce reviewer testing once an AppExchange review package is available and public Salesforce users after Salesforce Security Review and listing approval. Until the AppExchange listing is approved, existing governed Salesforce action payloads remain tenant-specific integration work and should not be treated as the public Salesforce AppExchange app.

Requirements

Before installing or testing the Salesforce integration, make sure you have:

  • An active Threada tenant.
  • Studio or Admin access for the Threada workspace that should create or update Salesforce Contacts.
  • A Salesforce production, sandbox, or reviewer-safe test org prepared for the reviewed package.
  • A Salesforce user who can authorize the AppExchange solution or approved OAuth app for the target org.
  • Permission to authorize the Threada External Client App or approved Connected App using the reviewed OAuth flow.
  • A configured Salesforce org mapping in Threada for the reviewed package.
  • For private reviewer testing, the exact AppExchange listing or review install URL, Salesforce org, reviewer user, setup notes, expected Contact fields, and cleanup instructions provided through the approved Salesforce review channel.

Do not use production customer Salesforce orgs, customer contacts, CRM exports, OAuth tokens, cookies, consumer secrets, developer keys, personal access keys, or screenshots containing private tenant data for AppExchange review evidence.

Install the app

After Salesforce approves the public listing, open Threada from AppExchange. During private review, use only the AppExchange install path, authorization path, or review link provided in the approved review notes.

  1. Open the AppExchange listing or approved review install URL for Threada.
  2. Review the app name, provider name, pricing information, shared-data disclosure, privacy, terms, and support links.
  3. Start the Salesforce OAuth authorization flow.
  4. Select the Salesforce org prepared for review.
  5. Review the requested scopes. V1 should request only api and refresh_token for the governed Contact workflow.
  6. Confirm the OAuth flow uses PKCE and the reviewed callback URL.
  7. Connect the app.
  8. Confirm Salesforce shows the app as authorized and Threada shows the Salesforce org as connected.

If authorization fails, stop and fix the AppExchange listing linkage, External Client App or approved Connected App configuration, callback URL, consumer key, PKCE, state validation, production URL, scope selection, or reviewer org setup before continuing.

Connect Salesforce to Threada

The Salesforce integration must be mapped to a Threada tenant and receiving workspace before approved proposals can create or update Contacts.

  1. Sign in to Threada Studio with an admin or builder account.
  2. Open the workspace or pack that should write Salesforce Contacts.
  3. Open the integration or channel setup area for Salesforce.
  4. Bind the authorized Salesforce org to the Threada workspace or pack.
  5. Select the receiving queue, approval policy, duplicate-matching rule, and Contact field allowlist.
  6. Save the mapping and run the connection test if one is available.

If the reviewed build does not yet expose a self-service Studio mapping UI, follow the reviewer setup notes for the exact Salesforce org, Threada workspace, queue, allowlisted Contact fields, and cleanup steps prepared for review. Do not infer tenant mappings from org names, user emails, Contact emails, or Contact titles alone.

Create or update a governed Salesforce Contact

Create or update a Salesforce Contact only through a governed Threada action proposal.

  1. Open or create the prepared Threada WorkItem or lead record.
  2. Create a Salesforce Contact upsert proposal using the reviewed workflow.
  3. Confirm the proposal shows the email, first name, last name, phone, title, account reference or company value, and other allowlisted fields that will be sent to Salesforce.
  4. Approve the proposal when the configured policy allows it.
  5. Confirm Threada shows a succeeded state and records the Salesforce Contact reference.
  6. Open the Contact in Salesforce and confirm the fields match the approved proposal.

Opportunity upsert, Lightning UI, Flow actions, Apex package behavior, metadata writes, Platform Events, webhook subscriptions, files/content access, analytics or Data Cloud access, and packaged Salesforce knowledge sync are follow-on capabilities. They must not be marketed until the public app proves the required scope set, field allowlists, tenant mapping, reviewer flow, audit behavior, and Salesforce Security Review evidence.

Setup-required responses

If the integration is authorized but not connected to a Threada tenant or workspace, Threada should show a setup-required response instead of silently dropping the request or attempting an unauthenticated Salesforce write.

Common setup issues:

  • The Salesforce org is not mapped in Threada.
  • The mapped Threada workspace or pack was disabled.
  • The receiving queue, duplicate-matching rule, or approval policy is missing.
  • Required Contact field allowlists are incomplete.
  • The AppExchange package still uses placeholder Partner Console solution ID, listing ID, consumer key, callback URL, install URL, support, privacy, terms, or setup identifiers.
  • The app points to a development, staging, ngrok, or otherwise non-production Threada URL.
  • OAuth PKCE, state validation, token exchange, refresh-token rotation, revocation, disconnect, or authorization-revocation handling failed.
  • Refresh-token rotation, refresh-token idle timeout, or refresh-token IP allowlisting has not been configured for the reviewed Salesforce OAuth app.
  • Security Review materials or reviewer org notes are missing.

For review builds, include the Salesforce org, Threada workspace, proposal ID, approximate test time, and sanitized error text in support requests. Do not send consumer secrets, refresh tokens, access tokens, cookies, developer keys, personal access keys, CRM exports, Contact lists, or private Contact content.

Disconnect or revoke

To stop creating or updating Salesforce Contacts:

  1. In Threada Studio, disable or remove the Salesforce mapping for the workspace, pack, or org.
  2. Revoke the Threada OAuth authorization in Salesforce if the org should no longer be connected.
  3. Run the reviewed test workflow and confirm Threada returns setup-required feedback rather than creating or updating a Contact.

Disconnecting the integration stops future Salesforce Contact writes. Existing WorkItems, proposals, approvals, Salesforce Contact references, and audit events remain available in Threada according to the tenant retention policy.

Data handling

For v1, Threada stores the Salesforce org mapping, OAuth authorization metadata, Salesforce Contact identifiers returned by Salesforce, and the Contact fields required for approved Contact creation or update. Threada uses this data only to create or update governed Salesforce Contacts, show setup and execution status, support disconnect/revocation, and maintain an auditable record.

The public install path must use Salesforce OAuth as the authorization method for multi-customer AppExchange distribution. Do not use username-password flow, session ID reuse, personal access tokens, private connected-app secrets, or manually provisioned tenant secrets as the public AppExchange install path. The shared-data disclosure in the listing must match the selected scopes and the v1 Contact data flow.

If a future version adds opportunities, Lightning UI, Flow actions, Apex, metadata writes, Platform Events, webhook subscriptions, file/content access, analytics or Data Cloud scopes, or packaged knowledge sync, Threada must update this guide, explain the exact data use, complete the required security and privacy review, and submit the updated app for Salesforce review before marketing the new capability.

Support

For setup help, contact support@threada.ai. For privacy or deletion requests, contact privacy@threada.ai. To report a security issue, contact security@threada.ai.

Support requests for the Salesforce integration receive a response within 2 business days. Include the Threada tenant, Salesforce org, proposal or Contact reference when available, app version when known, approximate test time, and sanitized error text. Do not send secrets, tokens, cookies, CRM exports, Contact lists, customer data, screenshots containing customer data, or raw OAuth logs.