How to Connect an AI Voice Agent to Salesforce: External Client App, Run As User and a Test Call in 10 Minutes

By Yatheendra, Founder, Brilo AI

Short answer: To connect an AI voice agent to Salesforce, create an External Client App in Salesforce Setup with OAuth and the Client Credentials Flow turned on, set a dedicated integration user as its Run As user, and paste the Consumer Key, Consumer Secret and your My Domain URL into the voice agent. Then give that user only the permissions your agent's actions need and place a scripted test call. With Brilo it takes about ten minutes and a Salesforce admin, not a developer.

Getting the keys to work is the easy part. Most failed setups break somewhere else: an edition without API access, an agent running as someone's personal login, a missing field permission that only shows up when a real customer calls.

This guide covers those decisions. The click-by-click steps live in our docs at Connect Salesforce, and we link to them at each stage rather than repeat them.

Before you start: edition, plan and access

Two checks prevent most failed setups. Do them before you open Setup.

1. Your Salesforce edition. A voice agent reads and writes records through the Salesforce API, so your org needs API access. Enterprise, Unlimited, Performance and Developer editions include it. Professional Edition only has it with the paid API add-on, and Essentials and Starter have none. Brilo's docs confirm Enterprise and above work.

To check, go to Setup, then Company Information, and read the Organization Edition field.

2. Your Brilo plan. Salesforce connects through the Brilo App Store, which comes with the Pro plan ($149 a month) and above. Free and Starter don't include it. Salesforce is also switched on per workspace, so open the App Store and check it's listed. If it isn't, ask support@brilo.ai to enable it before you change anything in Salesforce. See Plans and what they include.

You'll also need:

• System administrator access to the Salesforce org

• Your My Domain URL, which ends in .my.salesforce.com

• A phone you can call from, for the test in Step 5

Why a Salesforce External Client App, not a connected app

An External Client App is Salesforce's current framework for letting an outside service, such as an AI voice agent, sign in to your org over the API. Salesforce now steers new integrations toward External Client Apps, and Brilo uses one. If an older guide tells you to create a connected app, or to hand over a username, password and security token through a tool like Pipedream, skip it.

For a voice agent, the External Client App does two jobs:

• It issues a Consumer Key and Consumer Secret. Brilo exchanges them for an access token using the OAuth client credentials flow. Nobody signs in and no password is stored. Brilo requests a fresh token whenever Salesforce stops accepting the old one.

• It binds that token to one Run As user. Every lookup and write the agent makes runs as that user.

Three settings to get right:

• Distribution State: Local. This keeps the app inside your own org.

• OAuth scope: Manage user data via APIs (api). That's the only scope Brilo needs. Leave full, refresh_token and offline_access unticked, because the client credentials flow doesn't use refresh tokens.

• Callback URL. Brilo never redirects anyone to it, but Salesforce won't save the app without one, so use the value in our docs.

Did you know?

The OAuth client credentials flow has no user sign-in at all. The token belongs to the app and acts as the Run As user you choose. That's why the Run As user, not the app, decides what your voice agent can see and change.

Step 1. Create a least-privilege Run As user

This is the most important decision in the whole setup. The agent can do exactly what the Run As user can do, and nothing more.

Use a dedicated integration user, never a person's login. When an employee leaves and their user is frozen, an agent running as them stops working on the very next call. On Enterprise Edition, Salesforce recommends the free Salesforce Integration user licence with the API Only profile for this.

The user needs three things:

1. API Enabled, on its profile or a permission set

2. Read on Contact, because Brilo's connection test reads Contacts

3. The object and field permissions for each action you plan to give the agent

Build one permission set per job instead of one large one. Here's what a typical inbound receptionist agent needs:

Salesforce also hides fields per user. If an action runs but a field comes back blank or won't save, the Run As user is missing field-level access. The connection test won't catch this, because it only checks Contacts. The full permission list for every action is in our Salesforce docs.

Delete actions are off in Brilo until support enables them for a named agent. Most teams never need them. Move an Opportunity to Closed Lost instead of deleting it.

Step 2. Create the app and enable the flow twice

Follow the docs for each click. One step catches most admins: you enable the Client Credentials Flow twice, on two different screens.

• Settings (Flow Enablement). Ticking Enable Client Credentials Flow tells Salesforce the app is allowed to use the flow.

• Edit Policies (OAuth Policies). Ticking it again and entering the Run As username tells Salesforce your org permits it, and which user to act as.

Edit Policies is a separate screen from Edit Settings. Skip it and Brilo reports "Salesforce has not enabled this flow yet".

If your org restricts logins by IP range, set IP Relaxation to Relax IP restrictions on the same Policies tab. Otherwise Salesforce refuses the token request.

Step 3. Wait for Salesforce to publish the app

Salesforce can take up to 30 minutes to make a new External Client App available. It's usually quicker. But if the connection test fails within half an hour of creating the app, wait before you change anything. Most "my key doesn't work" tickets are exactly this.

Use the time well. Set up your agent's actions in Brilo and write the test script for Step 5.

Step 4. How to connect Brilo to Salesforce

1. In the Brilo App Store, choose Salesforce and click Connect.

2. Paste your My Domain URL, Consumer Key and Consumer Secret.

3. Brilo checks them with Salesforce before saving anything, so a bad value never reaches a live agent.

4. When the test passes, click Install App.

5. Open your agent's Actions tab and add only the actions it needs.

A workspace holds one Salesforce connection.

Step 5. Make a scripted test call

The connection test proves Brilo can sign in. It doesn't prove any action works, because a missing permission only appears when that action runs. So place one scripted call per action before real customers ring.

1. Create a test Contact with your own mobile number in the Phone field, stored in the same format your real records use.

2. Call the agent from that phone. It should greet you by name. If it doesn't, check the number format first. (415) 555-0123 and +14155550123 are different strings to an exact-match query.

3. Ask something that needs a lookup, such as "do I have an open case?", with a test Case on the Contact.

4. Give it something to write. Correct your email address, or ask for a callback.

5. Hang up and open the Contact. You should see a Task for the call and the corrected field.

6. Check the call log in Brilo for any action that errored, and fix the permission it names.

Repeat for every action. Then point real numbers at the agent.

Troubleshooting: what each error means

Brilo names the exact failure when the connection test doesn't pass.

Common mistakes

• Testing within 30 minutes of creating the app, then regenerating keys that were fine all along

• Ticking the Client Credentials Flow on Settings but not on Edit Policies

• Giving the Run As user a System Administrator profile instead of a scoped permission set

• Skipping the scripted call because the connection test passed

Pro tips

• Name permission sets after the job ("Voice agent: case creation") so the next admin knows why they exist.

• Store phone numbers in one format across Contacts and Leads before go-live.

• Add actions one at a time, and test each before adding the next.

What to set up next

Once you've connected your AI voice agent to Salesforce and the test calls pass, these are the natural next steps:

• Map call outcomes to your own fields and picklists: How to map call data to Salesforce fields

• Run automation off the Task the agent writes: How to trigger a Salesforce Flow when an AI call ends

• See what lands on the record: AI voice agent for Salesforce

• Still choosing a vendor? 8 best AI voice agents for Salesforce

One note on the phone side. Brilo answers on its own numbers or numbers you import or forward, and connects to Salesforce over the API, so there's nothing to install in your org.

Ready to connect an AI voice agent to Salesforce? Open the Brilo App Store, follow the docs, and place your first test call today.