Connect your Salesforce org
Everything in bluefactory starts from a connected org. If you signed up with Salesforce, your first org is already connected — this page covers adding more (a production org, its sandboxes) and what to check before your first backup.
Two ways to connect
Go to Settings → Salesforce Orgs and click Connect org. The page offers two authentication methods:
| Client credentials (recommended) | Sign in with Salesforce | |
|---|---|---|
| How it works | Server-to-server, through an External Client App you create in your own org | Interactive OAuth — you log in at Salesforce and authorize bluefactory |
| The connection belongs to | A dedicated run-as integration user you choose | Whoever clicked Authorize |
| Setup | A few minutes in Salesforce Setup, once | Instant |
| Best for | Production and any org running unattended | Trying bluefactory out, sandboxes, quick connections |
The connection belongs to an app and an integration user rather than to a person, so it survives someone leaving the company, a password reset or an MFA prompt — the usual reasons an unattended backup quietly stops running. You also decide exactly which user bluefactory runs as, and you can see and revoke that app in your own Salesforce Setup at any time.
Client credentials (recommended)
You'll need a Salesforce External Client App with the Client Credentials Flow enabled — see Create an External Client App for client credentials for the full walkthrough. It takes a few minutes and leaves you with three values: a My Domain URL, a consumer key and a consumer secret.
- Go to Settings → Salesforce Orgs and click Connect org.
- Open the Client credentials tab.
- Fill in the form:
- Display name (optional) — a friendly label, e.g. Acme Production.
- Instance / My Domain URL — e.g.
https://mydomain.my.salesforce.com. - Consumer key (Client ID) and Consumer secret — from your External Client App.
- Sandbox org — turn on if this is a sandbox rather than production.
- Click Connect org. bluefactory authenticates immediately, so a mistyped key or a missing run-as user is reported right away.
The secret is encrypted at rest and never shown again after saving.
[SCREENSHOT REQUIRED: Connect org page with the Client credentials tab filled in]
Sign in with Salesforce
- Go to Settings → Salesforce Orgs and click Connect org.
- Stay on the OAuth login tab and click Continue to Salesforce.
- Log in to the org you want to connect — Salesforce shows its login screen, so you can pick a different org than the one you're signed in with.
- Authorize access. You're back in bluefactory with the org listed.
bluefactory keeps a secure refresh token — no passwords are stored. The connection lasts until the authorizing user is deactivated or the token is revoked, at which point you reconnect the org.
[SCREENSHOT REQUIRED: Connect a Salesforce organization page]
Which Salesforce user should bluefactory use?
Whether it's the run-as user of your External Client App or the person who authorizes the OAuth login, that user's permissions define what bluefactory can see:
- API Enabled — required.
- View All Data — so backups aren't limited to the records one user's sharing rules happen to expose.
- Query All Files — required to back up Salesforce Files. Without it that user can only query the files it owns, even with View All Data.
- Modify All Data — needed only if you'll restore, seed or purge data in this org.
Use a dedicated integration user rather than a person's account, so backups don't depend on someone's employment or password cycle.
Metadata capture and hard deletes need a couple more permissions — see the full permission list.
Connect your sandboxes too
Sandbox connections unlock sandbox seeding and cross-org metadata comparison. Repeat either flow above against the sandbox — turning on Sandbox org, or logging in at the sandbox login screen — and the org's Type column shows which is which.
Next
Your org is connected — time for the quick start: your first backup.