Salesforce on Alibaba Cloud

​

Feature overview

Salesforce on Alibaba Cloud now supports using Alibaba Cloud Model Studio Connector to connect to the Salesforce on Alibaba Cloud MCP service, making the MCP tools provided by the service available to Qwen Work, Qoder, and other agent clients. After an administrator creates an External Client App in Salesforce on Alibaba Cloud and completes the OAuth 2.0 auth config and account authorization in Alibaba Cloud Model Studio Connector, Alibaba Cloud Model Studio Connector connects to the Salesforce on Alibaba Cloud MCP service and obtains its MCP tools. Agent clients can select and call these tools based on user intent to query or modify business data in Salesforce on Alibaba Cloud in real time for scenarios such as customer information queries, opportunity analysis, and sales collaboration. The Salesforce on Alibaba Cloud MCP service does not copy, chunk, or index Salesforce business data in advance. It accesses the source system in real time when an MCP tool is called. The accessible data depends on the permissions of the Salesforce user who completes OAuth authorization. The service does not bypass Salesforce object, field, or record access permissions. The integration works as follows:

​

Features

​

Standard MCP integration

Alibaba Cloud Model Studio Connector obtains MCP tools by connecting to the Salesforce on Alibaba Cloud MCP service and provides agent clients with a unified integration method. Agents can discover and call connected tools in the current workspace without integrating with each Salesforce API separately.

​

Secure OAuth 2.0 authorization

Alibaba Cloud Model Studio Connector uses an External Client App to complete the OAuth 2.0 authorization required to access Salesforce on Alibaba Cloud. The Salesforce on Alibaba Cloud MCP service provides MCP tool capabilities based on this authorization. Users sign in to Salesforce and grant authorization without providing their Salesforce usernames and passwords to agent clients.

​

Permissions inherited from the authorized user

MCP tool calls follow the existing Salesforce permission system. The objects, fields, and records that an agent can access depend on the permissions of the authorized Salesforce user, allowing enterprises to continue using their existing data access control policies.

​

Real-time access to business data

The Salesforce on Alibaba Cloud MCP service accesses Salesforce in real time when an MCP tool is called instead of periodically synchronizing a data copy. The agent can analyze and respond based on the latest customer, contact, opportunity, and other business information in the organization.

​

Reusable auth configs

Multiple connections can reuse the same auth config. An administrator maintains the Client ID and Client Secret of the External Client App in one place, while different users complete OAuth authorization separately to create independent connections.

​

Multiple environments and accounts

You can create separate auth configs and connections for production and sandbox organizations. You can also authorize different accounts with different permissions in the same organization. Include the environment and account purpose in each name to avoid mixing production and test connections.

​

Instructions

​

Prerequisites

Before you begin, make sure that you have:

1. Access to a Salesforce on Alibaba Cloud organization and administrator permissions to create and manage External Client Apps.
2. An Alibaba Cloud account with Alibaba Cloud Model Studio activated.
3. An Alibaba Cloud Model Studio workspace and its workspace ID, in a format similar to llm-xxxxxxxxxxxx.
4. A DashScope API key that belongs to the workspace.
5. An agent client such as Qwen Work or Qoder.

​

Step 1: Create an External Client App

1. Sign in to your Salesforce on Alibaba Cloud organization.
2. Go to Setup, enter App Manager in Quick Find, and click External Client App Manager.
3. Click New External Client App, and enter the app name, contact information, and other basic information.
4. Enable OAuth settings and set Callback URL to:
   Copy

   https://connector.aliyuncs.com/api/v1/bailian/connector/runtime/oauth/callback
   
   The Callback URL must exactly match this address. A difference in the protocol, domain, path, or trailing characters can cause OAuth callback validation to fail.
5. In OAuth Scopes, select at least the following three scopes:

   OAuth Scope	Scope value	Purpose
   Manage user data via APIs	api	Allows Connector to access Salesforce data available to the authorized user through APIs
   Manage user data via Web browsers	web	Supports the web-based OAuth authorization flow
   Perform requests at any time	refresh_token, offline_access	Allows Connector to refresh the access token while the authorization remains valid

6. Save the External Client App.

​

Step 2: Obtain the Consumer Key and Consumer Secret

1. In Setup, enter App Manager in Quick Find, and click External Client App Manager.
2. Click the External Client App that you created.
3. Open the Settings tab.
4. Expand OAuth Settings, and click Consumer Key and Secret.
5. Salesforce opens the Verify Your Identity page and sends a verification code to the email address of the current user.
6. Enter the verification code on the verification page, and click Verify.
7. Copy the Consumer Key. The Consumer Key is the Client ID in Alibaba Cloud Model Studio Connector.
8. Copy the Consumer Secret. The Consumer Secret is the Client Secret in Alibaba Cloud Model Studio Connector.

​

Step 3: Create an Alibaba Cloud Model Studio auth config

1. Go to the Alibaba Cloud Model Studio Connector console.
2. In the left-side navigation pane, click Auth configs, and then click Create auth config.
3. On the Select App page, select Salesforce on Alibaba Cloud.
4. Click Next, and enter the following information:

   Field	Description
   Config name	Identifies the organization and environment. We recommend the format organization-environment, such as CXG-production
   Org domain	The Salesforce on Alibaba Cloud org domain, such as xxx.my.salesforce.com. Do not enter login.salesforce.com
   Client ID	The Consumer Key of the External Client App
   Client Secret	The Consumer Secret of the External Client App

5. Click Finish. The config appears in the auth config list after it is saved.

Production and sandbox organizations use different domains. Create separate auth configs and do not use the same config for both environments.

​

Step 4: Connect Salesforce on Alibaba Cloud

1. In the left-side navigation pane of the Alibaba Cloud Model Studio Connector console, click Apps.
2. Find the Salesforce on Alibaba Cloud App, and click Connect.
3. In the Select auth config drop-down list, select the config that you created in the previous step.
4. Click OK. The browser redirects you to the Salesforce on Alibaba Cloud sign-in and authorization page.
5. Sign in as the Salesforce user whose data the agent will access, and grant authorization.
6. After authorization is complete, return to the Alibaba Cloud Model Studio console. In the Connected users section of the Salesforce App details page, confirm that the connection status is Connected.
7. In the Available tools section, view the input and output parameters of the MCP tools that Alibaba Cloud Model Studio Connector obtains from the Salesforce on Alibaba Cloud MCP Server. The actual tool set is subject to what the console displays.

You can create multiple user connections from the same auth config. Each connection inherits the Salesforce permissions of its authorized user.

​

Step 5: Connect Qwen Work, Qoder, or another agent client

Go to the Supported clients page in the Alibaba Cloud Model Studio console, select the agent client that you want to connect, and follow the integration instructions displayed on the page. Configuration methods vary by agent client. Follow the instructions for the selected client.

​

Step 6: Verify the connection

In Qwen Work, Qoder, or another agent client, enter a request related to Salesforce data. For example: Find the opportunities created this week and group them by stage. The agent selects MCP tools that Alibaba Cloud Model Studio Connector obtains from the Salesforce on Alibaba Cloud MCP service. The available data and actions depend on both the current tool capabilities and the permissions of the authorized Salesforce user.

​

Related documents

• Connector overview
• Salesforce: Create an External Client App