---
title: Connect for Salesforce
slug: cms-12/docs/connect-for-salesforce
docTags: 
createdAt: 2026-08-10T15:56:03.000Z
---

## Prerequisites

An Optimizely Content Management System (CMS) installation with Optimizely Forms and the required Marketing Automation connector components. See [Optimizely Connect for Marketing Automation](docId\:ts_gDosy9QODH5DQ8lldE).

## Install

The **Connect for Salesforce MA connector** is installed through the NuGet package [EPiServer.MarketingAutomationIntegration.Salesforce](http://nuget.episerver.com/en/OtherPages/Package/?packageId=EPiServer.MarketingAutomationIntegration.Salesforce). See [Add-ons platform compatibility](docId\:qlMSwdEfyS4CJlGWdudqk) for supported Optimizely versions.

## Configure

The connector supports two authentication methods. Use the one that matches your Salesforce org setup.

**Connected App (Username–Password flow)**

- You need an email address, password, and security token associated with your Salesforce account.
- You must configure the connection of form fields to Salesforce to send data from the specified fields to Salesforce.
- In your Salesforce user account, you must have *Marketing User* permissions.

**External Client App (Client Credentials flow)**

Available from `EPiServer.MarketingAutomationIntegration.Salesforce` 5.2.0. Use this option if your Salesforce org does not support creating Connected Apps.

- You need the **Consumer Key** (Client ID) and **Consumer Secret** (Client Secret) from a Salesforce External Client App configured with the Client Credentials grant type.
- You need your **Instance URL (My Domain)** from Salesforce (for example, `https://yourdomain.my.salesforce.com`).
- In your Salesforce user account, you must have *Marketing User* permissions.

These configurations are described in [Salesforce connector](docId\:lQK6UME73wMI1ceIGfm15) in the Optimizely User Guide.

## Encrypt credentials

Credentials are encrypted and saved based on one of the following options:

- `MAICryptoKey` – AES encryption with a SHA256-computer hash based on the value of the key.
  This key should be specified at the root level of the `appsettings.json` file with any string as its value.
- `machineKey` of the server.
  The `machineKey` encryption is used ONLY if `MAICryptoKey` is not specified. If you neglect to specify an `MAICryptoKey` in `appsettings.json`, the credentials are removed when the DXP instance is restarted
  because the `machineKey` is different and will fail to decrypt the credentials, so you must save credentials again through the configuration screen.

If the credentials are already encrypted using `machineKey` in an existing site, and the `MAICryptoKey` setting is added, then the credentials are deleted and must be re-entered.

:::hint{type="info"}
**Note**
The `MAICryptoKey` must be specified with the same value in ALL the DXP instances that are connected to the same database. If it is missing or the value is different in any of the instances, the credentials will be deleted and must be re-entered.
:::

**Related blog post:** [Creating multiple instances of the same connector](https://world.optimizely.com/blogs/jason-masterson/dates/2018/7/episerver-marketing-connectors---multiple-instances/) by Jason Masterson