Bolt.new AI and Salesforce integration: Step-by-Step Guide 2025

To integrate Bolt.new with Salesforce, you don’t “connect Bolt itself.” You build a normal web app inside Bolt.new, then talk to Salesforce through its REST API using OAuth (for user-level access) or a Connected App with a Client ID/Secret (for server-to-server). In practice, you create a Salesforce Connected App, enable OAuth scopes, drop the credentials into Bolt.new environment variables, and then make standard REST calls from your Bolt server routes. Bolt is just the workspace; the integration is the code you write plus the credentials you provide. Once that is set, your Bolt app can read/write Salesforce objects like Leads, Accounts, Contacts, and custom objects securely.

 

What Salesforce Integration Means in Bolt.new

 

Bolt.new runs a Node.js/Express backend you control. Integrating with Salesforce means your backend sends requests to Salesforce’s REST API. For that, you must authenticate using OAuth 2.0.

• OAuth 2.0 = secure login method where Salesforce issues access tokens.
• Connected App = a configuration inside Salesforce that gives you Client ID and Client Secret.
• Environment variables = secret values you store in Bolt.new so they are not hard-coded.
• REST API = Salesforce endpoint URLs for CRUD operations on objects.

 

Step-by-Step: Setting up the Salesforce side

 

• In Salesforce Setup, search for App Manager, create a New Connected App.
• Enable OAuth Settings.
• Set callback URL to something Bolt can serve, for example:
  https://YOUR-BOLT-APP-url/api/auth/salesforce/callback
• Select scopes such as:
  Access and manage your data (api)
  Perform requests on your behalf at any time (refresh_token, offline_access)
• Save → Salesforce generates a Consumer Key (Client ID) and Consumer Secret.

 

Step-by-Step: Configure Bolt.new environment

 

• Add these environment variables in Bolt.new:
  SF_CLIENT_ID
  SF_CLIENT_SECRET
  SF_REDIRECT_URI
  SF_LOGIN_URL (use https://login.salesforce.com for production, https://test.salesforce.com for sandbox)

 

Implement OAuth flow in Bolt.new (Node.js example)

 

Below is a working minimal version using plain fetch and Express. It shows how to begin the Salesforce login, then exchange the code for tokens.

 

// server.js (Bolt.new backend)

import express from "express";
import fetch from "node-fetch";
import dotenv from "dotenv";

dotenv.config();
const app = express();

const {
  SF_CLIENT_ID,
  SF_CLIENT_SECRET,
  SF_REDIRECT_URI,
  SF_LOGIN_URL
} = process.env;

// Start OAuth flow
app.get("/api/auth/salesforce", (req, res) => {
  const url =
    `${SF_LOGIN_URL}/services/oauth2/authorize` +
    `?response_type=code` +
    `&client_id=${SF_CLIENT_ID}` +
    `&redirect_uri=${encodeURIComponent(SF_REDIRECT_URI)}`;

  res.redirect(url);
});

// OAuth callback
app.get("/api/auth/salesforce/callback", async (req, res) => {
  const code = req.query.code;

  const tokenURL = `${SF_LOGIN_URL}/services/oauth2/token`;
  const body = new URLSearchParams({
    grant_type: "authorization_code",
    code,
    client_id: SF_CLIENT_ID,
    client_secret: SF_CLIENT_SECRET,
    redirect_uri: SF_REDIRECT_URI
  });

  const tokenResponse = await fetch(tokenURL, {
    method: "POST",
    body
  });

  const tokens = await tokenResponse.json();
  // tokens.access_token
  // tokens.instance_url
  // tokens.refresh_token (if scope allowed)

  res.json(tokens); // In production, store securely!
});

// Example: fetch Salesforce data using access token
app.get("/api/salesforce/accounts", async (req, res) => {
  const accessToken = req.headers["sf-access-token"]; // In real app, retrieve from session/DB.
  const instanceUrl = req.headers["sf-instance-url"];

  const response = await fetch(
    `${instanceUrl}/services/data/v57.0/query?q=SELECT+Id,Name+FROM+Account`,
    {
      headers: {
        Authorization: `Bearer ${accessToken}`
      }
    }
  );

  const data = await response.json();
  res.json(data);
});

app.listen(3000, () => console.log("Server running"));

 

How to test inside Bolt.new

 

• Run the backend inside Bolt.new.
• Visit /api/auth/salesforce in the preview browser → Salesforce login prompt.
• After authentation, Salesforce redirects back with tokens.
• Use tokens to hit routes like /api/salesforce/accounts.

 

Hardening for real production

 

• Store tokens securely (database, encrypted storage).
• Use refresh tokens to automatically renew access tokens.
• Validate allowed IP ranges or enforce CORS rules.
• Hide Client Secret in environment variables only.

 

Key idea

 

You are not “integrating Bolt” with Salesforce — you are integrating your Bolt-hosted application with Salesforce’s standard OAuth + REST API. Bolt.new simply gives you a place to write, run, and test the full integration end‑to‑end.