Connecting Voice Agents to Salesforce CRM

Salesforce is the de facto CRM for most mid-market and enterprise companies deploying voice AI. If your agent is doing anything meaningful in a business context — handling sales inquiries, supporting customers, qualifying leads, processing orders — there's a good chance the result needs to land in Salesforce. Getting the integration right is the difference between a voice agent that delivers value and one that generates orphan data. This piece walks through the Salesforce integration patterns that work, the auth and permission considerations, and the common pitfalls.

TL;DR

• Use the Salesforce REST API with OAuth 2.0 for most integrations.
• Model voice-agent events as Salesforce objects: Call, Task, Case, Opportunity, Lead, etc.
• Handle field validation, record types, and org-specific customization carefully.
• API limits (per-day, concurrent) matter at scale — plan for rate limiting and retries.
• Integration works best when designed with the Salesforce admin, not around them.

The integration surfaces

Voice agents interact with Salesforce in several ways:

Read.

• Look up caller by phone number.
• Pull case or opportunity history.
• Check account status, tier, preferences.
• Fetch custom field values for context.

Write.

• Create tasks for completed calls.
• Log call transcripts and summaries.
• Update case or opportunity status.
• Capture new leads from qualified calls.
• Schedule follow-ups.

Both.

• Read context, interact with caller, write outcomes.
• Update existing records based on call outcomes.

Authentication patterns

OAuth 2.0 Connected App. Most common. Create a Salesforce Connected App, use OAuth flows (Web Server, JWT Bearer, etc.) to authenticate your voice agent backend.

JWT Bearer Token. Good for server-to-server integrations with no user interaction. Requires certificate setup.

Named Credentials. Salesforce feature for managing auth centrally. Useful if your deployment spans multiple orgs.

Session-based / username-password. Avoid. Deprecated for new integrations.

Setting up a Connected App

Steps:

1. Salesforce Setup → App Manager → New Connected App.
2. Enable OAuth settings.
3. Define scopes: typically api, refresh_token, offline_access.
4. Set callback URL for OAuth flow.
5. Note the Consumer Key and Consumer Secret.
6. Set IP ranges if restricting access.

Test with a sandbox org before production.

The REST API basics

Base URL: https://{instance}.salesforce.com/services/data/vXX.X/

Key endpoints:

• GET /sobjects/{SObject}/{Id} — read a record.
• POST /sobjects/{SObject}/ — create a record.
• PATCH /sobjects/{SObject}/{Id} — update a record.
• GET /query?q={SOQL} — run SOQL.
• POST /composite — batch multiple operations.

Documentation: Salesforce REST API docs. Version regularly — pin to a specific version, upgrade deliberately.

Lookup by phone number

A common voice-agent flow: phone rings, look up caller.

SOQL:
SELECT Id, Name, Phone, MobilePhone, AccountId, Account.Name
FROM Contact
WHERE Phone = '+15551234567' OR MobilePhone = '+15551234567'
LIMIT 1

Normalize phone numbers (E.164 format) before querying. Handle cases where a phone matches multiple contacts (ask caller for clarification).

Creating call records

When a call ends, create a Task (or a custom object for Call logging):

POST /sobjects/Task/
{
  "Subject": "AI Voice Call",
  "Status": "Completed",
  "ActivityDate": "2026-04-16",
  "WhoId": "{ContactId}",
  "WhatId": "{AccountId}",
  "Description": "{Call summary}",
  "CallType": "Inbound",
  "CallDurationInSeconds": 243,
  "Call_Transcript__c": "{Full transcript}",
  "Call_Outcome__c": "Qualified"
}

Custom fields (suffixed __c) capture AI-specific data.

Handling record types

Many Salesforce orgs use Record Types to differentiate object variants:

• Different Case record types for support vs sales.
• Different Opportunity record types for renewal vs new business.

Your integration needs to know which record type to use. Check with the Salesforce admin.

Field validation

Salesforce orgs layer validation rules:

• Required fields per record type.
• Picklist values (constrained sets).
• Field dependencies.
• Duplicate rules.

Your integration must respect these or you get 400 errors. Test with a production-like sandbox.

API limits

Salesforce enforces rate limits:

• Per-day API limits. Based on org edition and user count. Hitting the limit blocks API until next day.
• Concurrent requests. Limited per org.
• Bulk API for large volumes. Use Bulk API 2.0 for 10K+ record operations.

At voice-AI scale, monitor usage. Implement retry with exponential backoff. Consider bulk-batching log writes if call volume is high.

Real-time vs batch

Real-time. Agent reads and writes during the call. Higher API usage, richer context. Required for anything the caller sees in-call.

Batch / deferred. Agent reads real-time; writes buffered and pushed in batches after calls. Lower API usage, acceptable for logs and non-urgent writes.

Most mature integrations do both — real-time reads, buffered batch writes for logging.

Integration architecture

Typical pattern:

• Voice agent → Middleware (your service) → Salesforce API.

Middleware handles:

• Auth and token refresh.
• Rate limiting and retries.
• Field mapping (agent data → Salesforce fields).
• Error handling.
• Logging and observability.

Don't have the voice AI talk directly to Salesforce — too brittle.

Common pitfalls

Custom field sprawl. Each integration adds a few custom fields. Over time, orgs accumulate dozens of voice-AI-specific fields. Coordinate with admin.

Ignoring Validation Rules. 400 errors in production. Test against sandbox that mirrors production.

Duplicate record creation. Voice agent creates a new Lead instead of matching an existing Contact. Frustrating for sales teams.

Hitting API limits. Usually during high-volume days or backup-processing spikes. Monitor.

OAuth token expiration. Tokens expire; refresh flow must work. Test failure scenarios.

Record permissions. The integration user must have permission on the objects and fields you're writing to.

Working with the admin

The Salesforce admin is your ally:

• They know the org's custom fields.
• They understand the validation rules.
• They can grant appropriate permissions.
• They'll tell you what naming conventions are expected.
• They care about data quality — involve them early.

Deployments where the voice AI team ignores the admin end up with painful re-architecture.

Example end-to-end flow

# Call comes in
1. Agent receives call, gets caller phone number.
2. Agent → middleware → Salesforce SOQL: find Contact by phone.
3. Middleware returns Contact + Account data.
4. Agent uses context in conversation.
5. Call progresses; agent captures outcome (qualified lead, support issue, etc.).
6. Call ends.
7. Agent → middleware: create Task against the Contact.
8. Middleware queues for batch write.
9. Every 60s, middleware batch-writes accumulated Tasks.
10. Salesforce reflects new call activity.

Event-driven integration

For modern orgs, consider Platform Events or Change Data Capture:

• Platform Events: publish events from voice agent to Salesforce for other systems to subscribe.
• Change Data Capture: subscribe to Salesforce changes (e.g., new Contact) to trigger voice agent outreach.

Useful for multi-system orchestration.

Testing

• Sandbox for development.
• Partial Copy / Full Copy sandbox for realistic testing.
• Integration user with minimum required permissions.
• Automated tests for each object type the agent writes.
• Error scenario tests (rate limit, validation error, duplicate rule hit).

Related reading

• Connecting Voice Agents to HubSpot CRM
• Twilio + Voice Agents: A Complete Guide
• Connecting Voice Lead Qual to Salesforce
• How to Integrate Voice Agents with a Custom REST API
• Sending Voice Agent Transcripts to Slack

FAQ

Can we integrate with Salesforce without a Connected App? Not really. Connected Apps are the standard auth mechanism.

What about Salesforce Service Cloud Voice? Salesforce's own voice channel. Integrates with CTI providers. Complementary to voice AI, not replacement.

Can voice AI create Opportunities? Yes, if the caller's status warrants it and admin permissions allow.

What about Einstein / Agentforce integration? Salesforce's own AI stack. Evolving — check current capabilities for your use case.

How do we handle multi-org setups? Multiple Connected Apps, Named Credentials to route. More complex; plan accordingly.