Salesforce is a cloud-based customer relationship management (CRM) platform that helps businesses manage their sales, marketing, and customer service activities in one place. This loader writes records into Salesforce objects through the Bulk API 2.0, with insert, update, upsert, delete, and hard_delete actions.

Prerequisites

The authenticating user needs the API Enabled permission, plus object and field-level access that matches the configured action.

Authenticate with one of three credential sets. When more than one is provided, the target selects JWT bearer, then OAuth refresh-token, then username/password.

• JWT bearer (jwt_client_id, jwt_username, jwt_private_key) — create a Connected or External Client App with the "Use digital signatures" option, upload an X.509 certificate whose private key you control, pre-authorize the user through a profile or permission set, and ensure the user has consented to the app once through the browser OAuth flow. Recommended for unattended, server-to-server use. See the JWT bearer flow docs.
• OAuth refresh-token (client_id, client_secret, refresh_token) — create a Salesforce connected app to obtain the client ID, client secret, and refresh token. See the web server OAuth flow.
• Username/password (username, password, security_token) — obtain the security token with Reset My Security Token in personal settings (not needed if the login IP is in the org's trusted IP ranges). This flow uses a SOAP login() call, which new orgs disable by default, so grant the user the Use Any API Auth permission through a permission set. This flow is deprecated, so prefer JWT bearer or OAuth.

Data requirements

Incoming records map to Salesforce objects by name, and Salesforce rejects a batch that does not line up:

• The stream name must match the target object's API name (case-insensitive), for example Account or a custom object like Invoice__c.
• Each property name must match a field's API name on that object (case-insensitive), including the __c suffix for custom fields. An unknown field fails the batch with InvalidBatch: Field name not found.
• For the default upsert action, include each record's Id — a valid 15- or 18-character Salesforce record ID — so the record updates its object. A blank Id inserts a new record, and a malformed or non-existent Id fails the record. The upsert always keys on Id, regardless of the stream's key properties.
• For a date or date-time field, match the property name to the field's API name exactly, including case. The target formats those values for Salesforce only on an exact match.

Settings

Client Id

OAuth client ID.

Client Secret

OAuth client secret.

Refresh Token

OAuth refresh token.

Username

User/password username.

Password

User/password password.

Security Token

User/password generated security token. Reset under your Account Settings.

JWT Client Id

JWT bearer: Salesforce Connected/External Client App consumer key (iss claim).

JWT Username

JWT bearer: Salesforce username to impersonate (sub claim).

JWT Private Key

JWT bearer: RSA private key contents in PEM format (not a file path), matching the cert uploaded to the Connected/External Client App.

Domain

Your Salesforce instance domain. Use login (default) or test (sandbox), or Salesforce My domain.

Is Sandbox

DEPRECATED: Use domain. is_sandbox: false == domain: login, is_sandbox: true == domain: test.

Action

How to handle incoming records by default:

• insert creates records (no Id; fields must be createable)
• update modifies records matched by Id (fields must be updateable)
• upsert updates on an Id match and inserts otherwise (fields must be createable and updateable)
• delete moves records to the Recycle Bin by Id
• hard_delete permanently removes records by Id, and needs the Bulk API Hard Delete permission

Salesforce enforces these rules in the Bulk job, so a mismatch surfaces as a Bulk job error.

Allow Failures

Allows the target to continue persisting if a record fails to commit.

Use Raw Stream Names

Whether to use raw stream names as Salesforce object names instead of the informal Singer convention of the last hyphen-separated part of the stream name. The default suits a database tap that names a stream <schema>-<table>, such as tap-snowflake, where public-Account loads to the Account object.