Direct answer

Integrate Salesforce with OpenClaw by: (1) creating a Salesforce Connected App (OAuth client) with the right scopes or a JWT certificate for server-to-server; (2) installing/configuring an OpenClaw skill in ClawHub and storing the Salesforce credentials (client id/secret, private key, refresh token, integration username, instance URL) in secrets/environment variables; (3) implementing the skill’s runtime code to perform OAuth token exchange (JWT or authorization-code/refresh flow), call Salesforce REST APIs using the returned access token, and handle errors/refreshes; and (4) routing Salesforce push events (Outbound Messages, Platform Events, Change Data Capture/Streaming) to an external, durable webhook or worker (not inside ephemeral agent runtime) that validates requests and invokes the OpenClaw skill through its configured entrypoint. Follow least-privilege permissions, use a dedicated integration user or scoped Connected App, and debug by inspecting token/API responses, ClawHub and skill logs, and Salesforce connected-app settings and user permissions.

Overview — what “integrating Salesforce with OpenClaw” means

• Salesforce is an external HTTP API and events source. You must authenticate and call its REST endpoints explicitly.
• OpenClaw (via ClawHub) runs skills/agents that can call external APIs if you give them credentials and code to do so; nothing is automatic.
• Stateful or always-on pieces (webhook endpoints, streaming subscriptions, durable queues) should live outside the short-lived agent process; the agent should be invoked explicitly when work arrives.

Preflight checklist

• Decide authentication mode: JWT Bearer (server-to-server) or Authorization Code with refresh token. Use JWT for backend-to-backend integrations without interactive users.
• Create a Salesforce Connected App and pick scopes you need (e.g., api, refresh\_token or equivalent). Use a dedicated integration user when appropriate.
• Plan how to handle inbound events: outbound messages, platform events, or Streaming API — these need a reachable webhook or a streaming worker outside the ephemeral agent runtime.
• Choose secure secret storage: ClawHub secret store or a cloud secret manager. Never hard-code client secrets or private keys in source.

Create the Salesforce Connected App (high level)

• In Salesforce Setup → App Manager → New Connected App (or similar): register your integration.
• Enable OAuth settings. For web flows provide redirect URLs (for interactive auth). For JWT, upload a signing certificate/public key and enable “Use digital signatures.”
• Select scopes: at minimum include the api scope; add refresh\_token if you use the authorization-code flow and need long-lived access.
• Note the Generated Client ID (Consumer Key) and Client Secret (if applicable), or download your certificate/private key for JWT.
• Ensure the integration user profile has API access and the required object/field permissions.

Configure the OpenClaw skill in ClawHub

• Install or upload your skill package to ClawHub per your organization’s process.
• Add required environment variables and secrets to the skill configuration: e.g., SF_CLIENT_ID, SF_CLIENT_SECRET (if using auth code), SF_PRIVATE_KEY (for JWT), SF_USERNAME (for JWT subject), and optionally SF_INSTANCE\_URL if you need to override sandbox vs production.
• If using an interactive OAuth flow, configure the skill to accept the authorization callback (or use an external auth handler that stores refresh tokens into ClawHub secrets).
• Set the skill’s runtime settings and ensure outbound network access to Salesforce endpoints (login.salesforce.com or test.salesforce.com and the REST API base).

Authentication options (patterns)

• JWT Bearer (recommended for backend integrations)
  • Create/upload a certificate in the Connected App and use the corresponding private key to sign a short-lived JWT.
  • Exchange the JWT at Salesforce’s token endpoint to receive an access token. No interactive user is required.
• Authorization Code + Refresh Token
  • Use a one-time interactive user consent to obtain a code, exchange it for an access token and refresh token, and store the refresh token securely. Use the refresh token to get new access\_tokens when needed.

Example: JWT Bearer token exchange (Node.js)

• This is a minimal, real example that signs a JWT and exchanges it for an access token at Salesforce.

// Dependencies: npm install jsonwebtoken node-fetch
const jwt = require('jsonwebtoken');
const fetch = require('node-fetch');

const SF_CLIENT_ID = process.env.SF_CLIENT_ID; // Connected App Consumer Key
const SF_USERNAME = process.env.SF_USERNAME;   // Salesforce integration username (sub)
const SF_PRIVATE_KEY = process.env.SF_PRIVATE_KEY; // PEM string, keep in secret storage
const SF_LOGIN_AUD = 'https://login.salesforce.com'; // or https://test.salesforce.com for sandbox
const SF_TOKEN_URL = `${SF_LOGIN_AUD}/services/oauth2/token`;

async function getAccessTokenWithJWT() {
  const now = Math.floor(Date.now() / 1000);
  const payload = {
    iss: SF_CLIENT_ID,    // issuer = client id
    sub: SF_USERNAME,     // subject = username of integration user
    aud: SF_LOGIN_AUD,    // audience = login URL
    exp: now + 3 * 60     // short expiry, e.g., 3 minutes
  };

  // // Sign the JWT with RS256 using your private key
  const assertion = jwt.sign(payload, SF_PRIVATE_KEY, { algorithm: 'RS256' });

  // // Exchange assertion for token
  const params = new URLSearchParams();
  params.append('grant_type', 'urn:ietf:params:oauth:grant-type:jwt-bearer');
  params.append('assertion', assertion);

  const res = await fetch(SF_TOKEN_URL, { method: 'POST', body: params });
  if (!res.ok) {
    const text = await res.text();
    throw new Error(`Token endpoint error: ${res.status} ${text}`);
  }
  const tokenResponse = await res.json();
  // tokenResponse.access_token and tokenResponse.instance_url are returned
  return tokenResponse;
}

Example: call Salesforce REST API after you have access_token

// // Use instance_url returned from token response and the access_token
async function queryAccounts(accessToken, instanceUrl) {
  // // Replace vXX.X with the API version you target, or use the latest supported
  const apiVersion = 'vXX.X';
  const q = encodeURIComponent('SELECT Id, Name FROM Account LIMIT 5');
  const url = `${instanceUrl}/services/data/${apiVersion}/query?q=${q}`;
  const res = await fetch(url, {
    headers: { 'Authorization': `Bearer ${accessToken}`, 'Accept': 'application/json' }
  });
  if (!res.ok) {
    const body = await res.text();
    throw new Error(`API error: ${res.status} ${body}`);
  }
  return res.json();
}

Handling inbound events (webhooks / streaming)

• Do not rely on an ephemeral agent runtime to accept long-lived streaming connections (CometD) or to be always reachable for webhooks. Run a small external web service or worker that is always reachable and durable.
• The external service should validate incoming requests per Salesforce’s recommended method (signature, session validation, or SOAP outbound message validation). Use Salesforce documentation to confirm the exact validation header/approach for the event type you use.
• After validation, the external service should call the OpenClaw skill by making an explicit API call to its entrypoint (or enqueue a job that a skill picks up). Do not assume the agent automatically receives Salesforce pushes.
• Use a queue (SQS, Pub/Sub, RabbitMQ) between the webhook receiver and the OpenClaw skill for retries, back-pressure, and decoupling.

Runtime architecture and state

• Keep ephemeral logic (transform, enrich, synchronous requests) inside the skill code. Keep durable state (failed jobs, checkpoints, subscription offsets) in external storage (database, object store).
• For streaming/CDC, persist offsets and rehydrate on restart from an external store. For webhooks, persist delivery status and implement retries externally.
• Limit long-running blocking work inside the agent. If a job takes >120 seconds (or your platform’s timeout), hand it to a background worker outside the agent runtime.

Security and permission guidance

• Use least privilege: only grant API/object permissions required by the integration user or Connected App.
• Store secrets (client secrets, private keys, refresh tokens) in ClawHub secret storage or a secure secret manager and reference them from the skill configuration.
• Rotate keys and client secrets periodically; for JWT rotate certificates and update the Connected App’s public key accordingly.
• Use dedicated integration users or Named Credentials (on Salesforce) when appropriate to reduce blast radius.

Common errors and debugging checklist

• Authentication failures: inspect token endpoint response body for error and error\_description. Check that your iss, sub, aud, and certificate are correct for JWT; check redirect URL and client secret for auth-code flows.
• Insufficient scope / permission errors: verify Connected App scopes and the integration user’s profile/permission sets include API and object access required.
• Wrong instance URL: after token exchange use the returned instance\_url for API calls. If you hardcode production vs sandbox endpoints, you can call the wrong host.
• Network/connectivity: confirm your skill’s runtime has outbound access to login.salesforce.com and the Salesforce instance host; check proxies and firewall rules.
• Rate limits and API errors: check returned error codes and the Salesforce headers for limits; implement exponential backoff and retries where appropriate.
• Webhook delivery issues: confirm the external webhook receiver is reachable from Salesforce, log the full request body/headers, and confirm your validation logic matches Salesforce docs.
• ClawHub/skill invocation: confirm the skill is deployed, environment variables are present, and logs show the skill starting and performing the exchange. If you expect the agent to be invoked, verify the external trigger calls the skill’s configured entrypoint/API.

Operational notes

• Test against a Salesforce sandbox (test.salesforce.com) before production. Swap endpoints and Connected App settings accordingly.
• Log token responses and errors (without logging secrets). Keep sufficient telemetry in both the external webhook service and the OpenClaw skill so you can trace a request end-to-end.
• Monitor quota usage and add visibility into failed auth attempts, webhook failures, and API throttles.