> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wejam.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting Salesforce Connection

> Fix OAuth errors, permission issues, and sandbox problems when connecting Jam Assistant to Salesforce.

Jam Assistant connects to Salesforce using OAuth 2.0 - no password is stored. This guide covers how to connect, what permissions you need, and how to fix the most common errors including sandbox and enterprise SSO setups.

Jam Assistant supports **any Salesforce org** that allows OAuth access: production orgs, sandbox orgs (Developer / Partial / Full), QA sandboxes with "My Domain" URLs, and enterprise orgs with SSO (Okta / Azure AD) where the org permits OAuth for external apps.

***

## Connecting Jam Assistant to Salesforce

In **Settings → Integrations**, click **Connect Salesforce** and choose your connection type:

* **Production** - for most customers, starts OAuth at `login.salesforce.com`
* **Sandbox** - for sandbox orgs, starts OAuth at `test.salesforce.com`
* **Org-specific login URL** - for QA or "My Domain" sandboxes (e.g. `yourcompany--qa.sandbox.my.salesforce.com`)

You'll be redirected to Salesforce to log in and approve access. After clicking **Allow** on the consent screen, you'll land back in Jam Assistant with a "Salesforce connected successfully" confirmation.

<Note>
  If your org enforces "My Domain" logins, start the OAuth flow using the
  **Org-specific login URL** option - the global `login.salesforce.com` won't
  route you to the right org.
</Note>

***

## Checking Your Permissions

To connect Salesforce for the first time, you typically need a Salesforce user with permission to approve or install OAuth apps - usually a Salesforce Admin.

If you see **OAUTH\_APPROVAL\_ERROR\_GENERIC** or "You don't have permission to approve this app", you don't have the required permissions. This is normal for most sales reps. Ask your Salesforce Admin to connect first; once the app is installed in your org, other users can connect without admin permissions.

To get your admin set up:

1. Go to the [Users page](https://app.wejam.ai/users) on the platform and invite your admin's email with the **Admin** role
2. Ask them to follow the connection steps above
3. They may see an `invalid_client` error on their first attempt - this is expected; see the troubleshooting section below

***

## What Jam Assistant Can Do Once Connected

After connecting, you can ask Jam Assistant to search and view records ("Show me my open deals"), create and update records ("Log a meeting with John Smith"), log emails, manage tasks, and access meeting context.

**Jam Assistant respects your Salesforce permissions.** It can only access data you're already authorized to see in Salesforce - if a record is hidden from you there, it's hidden from Jam Assistant too.

***

## Managing the App as a Salesforce Admin

Admins can manage Jam Assistant under **Setup → External Client App Manager → Jam Assistant** or **Setup → Connected Apps OAuth Usage → Jam Assistant**. These pages contain the settings needed to fix the most common issues.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="OAUTH_APPROVAL_ERROR_GENERIC - You don't have permission to approve this app">
    The user connecting doesn't have permission to install OAuth apps. Ask your Salesforce Admin to connect first. The admin will likely see an `invalid_client` error on their first attempt - that's expected; ask them to follow the `invalid_client` steps below, then retry. After the app is installed, other users can typically connect without admin permissions.
  </Accordion>

  <Accordion title="invalid_client - app must be installed into org">
    Jam Assistant uses Salesforce's External Client App framework, which requires explicit installation in each org before OAuth can proceed. This is a Salesforce requirement, not a bug.

    **Fix (Salesforce Admin):**

    1. Go to **Setup → Connected Apps OAuth Usage**
    2. Find **Jam Assistant** (if it doesn't appear yet, attempt the OAuth connection once to surface it, then refresh)
    3. Click **Install** and review permitted users if needed
    4. Retry connecting in Jam Assistant
  </Accordion>

  <Accordion title="invalid_client after cloning or refreshing a sandbox">
    When you clone or refresh a Salesforce sandbox, Jam Assistant is not automatically carried over - it must be installed fresh in each sandbox org.

    **Fix (Salesforce Admin):** Follow the same `invalid_client` steps above inside the sandbox org. Attempt the OAuth connection once to surface Jam Assistant in **Connected Apps OAuth Usage**, then install it.
  </Accordion>

  <Accordion title="User is not approved to access this app">
    Jam Assistant is installed, but the user's profile or permission set isn't allowed to authorize it. The admin needs to open Jam Assistant in Salesforce and update the permitted users or policies.
  </Accordion>

  <Accordion title="This app isn't allowed in your organization">
    Org security policies are blocking OAuth - common causes include IP restrictions, strict session settings, or an explicit app blocklist. The admin should review **Setup → Login IP Ranges**, **Setup → Session Settings**, and **Setup → Connected Apps OAuth Usage** to ensure Jam Assistant is allowed and installed.
  </Accordion>

  <Accordion title="Invalid login URL - routed to the wrong Salesforce org">
    The OAuth flow started at the wrong Salesforce login URL. If you normally log in via `login.salesforce.com` choose **Production**; via `test.salesforce.com` choose **Sandbox**; via a company-specific URL (e.g. `yourcompany--qa.sandbox.my.salesforce.com`) choose **Org-specific login URL**. If you're unsure, copy the URL from your browser when you log into Salesforce and share it with your admin.
  </Accordion>

  <Accordion title="Connected, but Jam Assistant can't access certain data">
    Salesforce profile permissions don't grant access to the relevant objects or fields. The admin needs to ensure the user has access to the objects Jam Assistant should use - Accounts, Contacts, Opportunities, Tasks, Events, Notes, Emails, and any custom objects or fields.
  </Accordion>
</AccordionGroup>

***

## Disconnecting and Reconnecting

To disconnect, go to **Integrations**, find Salesforce, and click **Disconnect**. To reconnect, follow the connection steps again - if the app is still installed in your org, you won't need admin permissions the second time.

***

## Security & Privacy

Your Salesforce password is never stored - Jam Assistant receives only a secure OAuth token that expires regularly. Your CRM data stays in Salesforce; Jam Assistant accesses it in real-time and does not copy or store records. You can revoke access at any time by disconnecting in settings or having your admin uninstall the app. All API calls Jam Assistant makes are logged in your Salesforce org's audit trail.

***

## Still Stuck?

If you've tried the steps above and still can't connect, email [support@wejam.ai](mailto:support@wejam.ai) with the exact error message, a screenshot or screen recording, and your Salesforce org name.

***

## Related Documentation

* [Salesforce Admin Guide](/external/assistant/salesforce-admin-guide) - Setting up the Connected App
* [Integrations](/external/assistant/integrations) - Connect HubSpot, email, and calendar
* [Discovering Your CRM Schema](/external/assistant/crm-schema) - Keep Jam Assistant up to date after CRM changes