> For the complete documentation index, see [llms.txt](https://docs.decube.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.decube.io/saas/salesforce.md).
# Salesforce
Add a Salesforce connection to your decube connections so that you can discover the lineage of your data from source objects to reports and dashboards.
Connect Salesforce to decube to catalog your objects and fields, and trace lineage from source objects through to the reports and dashboards built on them.
## Supported Capabilities
{% tabs %}
{% tab title="Supported Capabilities" %}
**General**
* **Metadata** — metadata extraction and display of asset information (objects, fields, reports, dashboards). Types collected: Schema, Table, Column, Chart, Dashboard
**Lineage**
* **Foreign Key Lineage** — tracks relationships between objects, inferred from lookup and master-detail field relationships
* **BI Lineage** — traces lineage from the specific object fields a report displays or groups by (Column → Report), and from reports to the dashboards they power (Report → Dashboard)
{% endtab %}
{% tab title="Not Supported" %}
**General**
* Profiling
* Preview
* Data Quality (Classic)
* Data Quality V2 — not supported yet
* External Table
* View Table
* Stored Procedure
{% endtab %}
{% endtabs %}
## Connection Requirements
Connecting to Salesforce requires an OAuth 2.0 app and supports two authentication methods.
### JWT Bearer Flow (Recommended)
* `Client ID`
* `Username`
* `Private Key` (uploaded as a file, paired with a self-signed certificate on the app)
* `Domain`
### Username-Password Flow (Legacy)
* `Client ID`
* `Client Secret`
* `Username`
* `Password`
* `Security Token`
* `Domain`
{% hint style="warning" %}
This flow works only with a **Connected App (Legacy)** — it isn't available on the newer **External Client App (ECA)** type. Use the JWT Bearer flow above if you're setting up an ECA.
{% endhint %}
{% hint style="info" %}
**`Domain`** is only the subdomain, not the full URL. For `https://mycompany.my.salesforce.com`, enter `mycompany.my`. For a standard login, use `login`; for a sandbox, use `test`. Don't include `salesforce.com` or the `https://` prefix.
**`Security Token`** (Username-Password flow only) resets from the Salesforce UI under **Settings → My Personal Information → Reset My Security Token** (Classic: **My Settings → Personal → Reset My Security Token**). Salesforce emails the new token to the user's registered email address — it isn't visible anywhere in the UI.
{% endhint %}
### Minimum Permissions
The integration user needs only the following — no admin-level access required.
**User Permissions**
* `API Enabled`
* `Run Reports`
* `View Setup and Configuration`
**Object Permissions**
* Required only for **Column → Report** BI lineage — you need at least `Read` access on the sObject(s) those columns belong to, and on any upstream objects the report columns reference.
### Setting Up the External Client App (ECA)
1. Go to **Setup** → **External Client Apps** → **New External Client App**, and enable **OAuth Settings**.
2. Set a **Callback URL** (e.g. `https://login.salesforce.com/services/oauth2/callback`) — Salesforce requires this field, but the JWT flow doesn't use it.
3. Under **Selected OAuth Scopes**, add the following scopes:
* `Manage user data via APIs (api)`
* `Perform requests on your behalf at any time (refresh_token, offline_access)`
4. Under **Flow Enablement** → **Enable JWT Bearer Flow**, upload a self-signed certificate — the paired private key becomes the `Private Key` credential. See Salesforce's [Generate a Self-Signed Certificate](https://help.salesforce.com/s/articleView?id=sf.security_keys_creating.htm\&language=en_US\&type=5) guide and [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?language=en_US\&id=sf.remoteaccess_oauth_jwt_flow.htm\&type=5) for background on the flow.
5. Save, then select **Edit Policies** from the dropdown next to the new ECA in the **External Client App Manager** page.
6. Under **App Policies**, select the profile or permission set tied to the integration user.
7. Under **OAuth Policies**, set **Permitted Users** to **Admin approved users are pre-authorized**.
## What decube Collects
* **Tables and Columns** — customizable standard and custom sObjects and their fields
* **Foreign Key Lineage** — lookup and master-detail relationships between objects
* **Charts and Dashboards** — Reports (as Charts) and Dashboards that are public, private to the user, or shared to the user
* **BI Lineage**
* Column → Report (requires explicit object-level permission)
* Report → Dashboard
## Examples of lineages from Salesforce
