Connect Salesforce to NextSay
NextSay reads the open deal before each call — contact, opportunity, stage, next step — in Copilot and Intel, and, if you allow it, logs a one-line read of the call back onto the deal afterward. You control the direction; NextSay never sees your password.
Set up once, by an admin. The connection is workspace-wide — your other members just get the features (contact search, live deal context, auto-logged calls) and never touch any of this. Plan ~10 minutes.
Before you start
1 · Create the app in Salesforce
Salesforce restricts new Connected Apps as of Spring '26 — use an External Client App. An admin does this once, all in Salesforce Setup:
- Open External Client App Manager. In Setup, use Quick Find → External Client App Manager → New External Client App.
- Name it. Enter an External Client App Name (API Name auto-fills) and a Contact Email; leave Distribution State = Local.
- Enable OAuth. Check Enable OAuth to reveal the OAuth settings.
- Set the Callback URL to the exact value in NextSay's Set up dialog (production
https://nextsay.ai/app) — it must match byte-for-byte. - Add the scopes. Move to Selected OAuth Scopes: Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access). Create.
- Copy the keys. Open the app → Settings → OAuth Settings → Consumer Key and Secret (complete the identity check if prompted) → copy the Consumer Key and Consumer Secret.
Include the refresh-token scope. The full scope does not include it — without Perform requests at any time the connection drops after about an hour.
Salesforce's own steps, in full: Configure External Client App OAuth Settings · OAuth Tokens & Scopes
2 · Connect in NextSay
- Settings → Integrations → Salesforce → Set up.
- Paste the Consumer Key and Secret; choose your login host.
- Connect. You approve on Salesforce's own page. NextSay stores only the returned token, server-side — never your password.
| Consumer Key | From the app's OAuth settings. |
|---|---|
| Consumer Secret | From the same place (reveal it in Salesforce). |
| Login host | Production login.salesforce.com · Sandbox test.salesforce.com · or your My Domain URL. |
3 · Choose the sync direction
On the connected card, set the Sync switch (you confirm before it changes).
Members use their own login (optional)
Who does what
| Workspace admin (NextSay) | Connected Salesforce card → turn on Members use their own login. |
|---|---|
| Salesforce admin | Connected App → Permitted Users = All users may self-authorize. Give each rep their own Salesforce user. |
| Each member (NextSay) | Integrations → Salesforce → Connect your own Salesforce → sign in. One click, no keys, never a secret. |
To actually restrict what a rep sees (Salesforce enforces this, not NextSay): Sharing Settings → Org-Wide Defaults → set Account, Contact, Opportunity → Private (else everyone sees all), and records must be owned by the right user (a rep sees records they own + anything shared or below them in the role hierarchy). A member who hasn't connected falls back to the shared connection. Salesforce-only — HubSpot tokens are account-wide.
What's synced & to which object
Reads (live, never copied) — fetched when you pick the prospect, used for the call, not stored:
| Contact / Lead | name, email, title, account |
|---|---|
| Opportunity (open) | name, stage, amount, close date, type, next step |
Writes (only when Sync = Bidirectional) — one object:
| Task (Completed Call) | WhoId = contact, WhatId = the opportunity — a one-line read + the single top ⚠ Risk + a pull-link back to NextSay. |
|---|
Never written: Salesforce-owned fields — outcome, stage, amount, close date, next step. The full read, transcript, and signals stay in NextSay, linked not copied. The write is self-healing, idempotent (a retry never duplicates), and the opportunity link is best-effort.
Integration status
A session's Details tab shows the CRM sync state:
| Success | The read was logged — tap it to open the Task on the opportunity. |
|---|---|
| Pending | The log is in flight. |
| Failed | It didn't log — the saved error shows inline (expand it); Retry re-runs it. |
| Not synced | CRM-linked but nothing logged yet (e.g. Inbound-only) — opens the contact. |
Searching for a prospect
Everywhere you start a call — Prospects, Copilot setup, Role Play — the picker searches Salesforce live:
Where it shows up
Security
FAQ
Do all users have to set this up?
No. An admin connects once; the connection is workspace-wide. Other members just get contact search, deal context, and auto-logged calls — they never repeat the setup or see any keys.
Can each rep see only their own records?
Yes — an admin turns on Members use their own login, then each member connects their own Salesforce (one click, no keys). Their reads run under their own login, so Salesforce enforces their permissions and they see only their records. Salesforce-only; HubSpot's tokens are account-wide.
Does NextSay change my Salesforce records?
No. It only adds a Completed-call activity; it never edits fields Salesforce owns (outcome, stage, amount, close date).
Where is a call logged, and could it duplicate?
As a completed Call activity on the matched opportunity and contact. One per call — it updates in place, never duplicates.
Can I keep NextSay read-only?
Yes. Set Sync to Inbound only.
Do you copy my Salesforce data into NextSay?
No. Fields are read live; NextSay stores only a reference, never a mirror.
Does NextSay see my Salesforce password?
No. You sign in on Salesforce; NextSay gets only a token, kept server-side.
Can I connect a sandbox?
Yes — use login host test.salesforce.com or your sandbox My Domain URL.
Who can set this up?
Workspace admins only.
What happens to logged calls if I disconnect?
They stay in Salesforce. Disconnecting only stops future reads and write-backs.
Troubleshooting
redirect_uri_mismatchrefresh_token scope — add it and reconnect.Disconnect
Settings → Integrations → Salesforce → expand → Disconnect. Reads and write-backs stop immediately; your Salesforce data is untouched, and you can reconnect any time.