Connect Salesforce MCP to ClickUp so your AI tools can search, read, create, and update Salesforce records in natural language.

This guide covers the one-time Salesforce setup a Salesforce administrator needs to do, then how to connect from ClickUp using OAuth 2.0 with PKCE. The process should take about 20 minutes, with an additional 30 minutes for Salesforce to activate the app.

What you'll need

• A ClickUp Workspace
• A Salesforce org (Enterprise Edition or above, or Developer Edition) with System Administrator permissions
• The Customize Application permission in Salesforce

Salesforce steps

Before you can complete the process inside ClickUp, there are several Salesforce setup steps.

When you finish the Salesforce steps, you'll bring three things back to ClickUp:

• The Consumer Key from your external client app
• Whether you're connecting a production or sandbox org
• Which MCP server you activated

Step 1: Enable the MCP service

Salesforce-hosted MCP servers are only displayed in the Salesforce Setup page once the MCP service is turned on for your org:

1. On the Salesforce Setup page, type MCP Servers in the Quick Find box.
2. If MCP Servers is displayed under API Catalog, the service is already on. Skip to Step 2: Activate a server.
3. If it's not displayed, type User Interface in the Quick Find box, open User Interface, and turn on Enable MCP Service. Then save.

If you can't find MCP Servers, check that your org's edition supports hosted MCP servers.

Step 2: Activate a server

MCP servers are off by default. An administrator has to turn on each one before any client can connect:

1. On the Salesforce Setup page, type MCP Servers in the Quick Find box.
2. Click MCP Servers under API Catalog.
3. Turn on the server your team needs. ClickUp supports these:
   • SObject Reads (recommended): Searches and retrieves records and relationships
   • SObject All: Creates, reads, updates, and deletes records
   • SObject Mutations: Creates and updates records, no deletions
   • Headless 360 (beta): Unified access to the wider Salesforce platform

If you skip this step, ClickUp signs in successfully but finds no tools. You'll pick this same server in ClickUp, so note which one you turned on.

It can take up to 2 minutes for a server to become active after you turn it on.

For the full reference, see Salesforce's guide to activating MCP servers.

Step 3: Create an external client app

You must use an external client app. Connected apps aren't supported for MCP and cause authentication failures.

To create an external client app:

1. On the Salesforce Setup page, type External Client in the Quick Find box.
2. Click External Client App Manager.
3. Click New External Client App.
4. Fill in the Basic Information section. Name the app something like ClickUp MCP.
5. Expand API (Enable OAuth Settings) and check Enable OAuth.

Keep this form open. Steps 4 to 6 will have you fill in the rest of it.

If ClickUp later reports an invalid client, the Consumer Key you pasted doesn't belong to this app, or the app hasn't finished propagating yet (Step 8).

For the full reference, see Salesforce's guide to creating an external client app.

Step 4: OAuth security settings

On the same form, under Security:

1. Check these options:
   • Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows
   • Enable Refresh Token Rotation
   • Issue JSON Web Token (JWT)-based access tokens for named users
   • Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days

• Leave these unchecked:
  • Require secret for Web Server Flow
  • Require secret for Refresh Token Flow
  • Enforce Refresh Token IP Allowlist

ClickUp uses PKCE as a public client, so it doesn't need the consumer secret. If you require a secret here, the connection fails.

Step 5: Add the callback URL

In the Callback URL field, enter ClickUp's callback URL:

https://search.clickup-prod.com/connect/salesforcemcp

The callback URL must match exactly, with no trailing slash. ClickUp shows the same value in its guided setup so you can compare.

Step 6: Add OAuth scopes

To add OAuth scopes:

1. Under Selected OAuth Scopes, add:
   • mcp_api: Access Salesforce hosted MCP servers
   • refresh_token, offline_access: Perform requests at any time
2. Click Create.

If you set this up during the Salesforce MCP beta, the old scopes (api, sfap_api, einstein_gpt_api) no longer work. Use mcp_api and refresh_token. See Salesforce's beta to GA transition guide.

Step 7: Assign a permission set

By default, anyone in your org can connect to the app. To limit access to specific people, use a permission set. This step is optional.

The permission set only controls who can connect. Each person's existing Salesforce object, field, and sharing permissions still apply to every tool call.

To assign a permission set:

1. Create a permission set for ClickUp MCP users, like ClickUp MCP User. It doesn't need any extra permissions.
2. Assign it to everyone who will connect from ClickUp.
3. In External Client App Manager, open your app and click Policies.
4. Under OAuth Policies, set Permitted Users to Admin approved users are pre-authorized.

5. Under App Policies, move your permission set to Selected Permission Sets. Leave Selected Profiles empty.

6. Click Save.

If you pick Admin approved users are pre-authorized and don't select a permission set, nobody can connect.

Leave OAuth Custom Scopes empty. ClickUp only needs the scopes from Step 6.

Step 8: Wait for the app to propagate

A new external client app can take up to 30 minutes to become available, similar to DNS propagation. If ClickUp fails shortly after setup, wait and try again.

While you wait, copy your consumer key:

1. In External Client App Manager, open the app you created.
2. Click Settings.
3. Click Consumer Key and Secret under OAuth Settings.
4. Copy the Consumer Key. It starts with 3MVG9.

Connect in ClickUp

Salesforce OAuth uses your active browser session. Before you start, get your browser ready:

1. Log out of every other Salesforce org in your default browser.
2. Log in to the org that has your external client app, and keep the browser open.

This stops the sign-in from landing in the wrong org. See Salesforce's guide to logging into your org.

Once your browser is ready, you can connect in ClickUp:

1. Open the App Center.
2. Search for and select Salesforce.
3. Select a tab to choose a connection type:
   • Personal connection: only you can use the Salesforce tools in ClickUp. Your Salesforce identity and permissions are used for every tool call.
   • Workspace connection: any Workspace member can use the Salesforce tools, but each person signs in with their own Salesforce credentials and, if you restricted access in Step 7, needs that permission set. Everyone shares the same external client app, but each person has their own authorization.
4. Click Connect to open the guided setup.
5. Under Which org are you connecting?, pick Production / Developer Edition or Sandbox / Scratch org.
6. Under Which server did you activate?, pick the server you turned on in Step 2.
7. Check that the callback URL shown in ClickUp matches the one in your external client app.
8. Paste your Consumer Key from Step 8.
9. Click Next.
10. Approve access when Salesforce asks.
11. Wait for ClickUp to validate the connection and load your tools.

Limitations

Known limitations and common issues with Salesforce MCP:

• Propagation delay: A new external client app can take up to 30 minutes to work. If the first attempt fails, wait and retry.
• Connected apps don't work: You must use an external client app.
• Server not turned on: Sign-in works, but no tools load if the server you picked in ClickUp isn't active in Salesforce.
• Restricted access: If you limited access with a permission set in Step 7, people without it can't connect. Assign it to them, or switch Permitted Users back to All users can self-authorize.
• Only four servers in ClickUp: The guided setup supports SObject Reads, SObject All, SObject Mutations, and Headless 360 (beta). Other Salesforce MCP servers, like SObject Deletes or Data Cloud SQL, aren't available in ClickUp yet.
• Several orgs in one browser: If you're logged into more than one org, sign-in may hit the wrong one. Log out of the others first.
• API limits and billing: MCP tool calls count against your org's API request limits, and Salesforce may bill MCP usage through Flex Credits. Check API Usage in the Salesforce Setup page.
• Scratch orgs: You can't create external client apps in scratch orgs from the Salesforce Setup page. Create the app in a Dev Hub org, package it, and install it in the scratch org.
• Beta setups: Old beta scopes and URLs containing v1-beta.2 no longer work. ClickUp's guided setup uses the GA URL format automatically.

Disconnect or revoke access

To disconnect from ClickUp:

1. In the App Center, search for and select the app.
2. Select the Personal or Workspace tab.
3. Next to Connected, click the ellipsis ... icon.
4. Select Disconnect.
5. To confirm, click Disconnect.

To fully revoke access from the Salesforce side:

1. On the Salesforce Setup page, open External Client App Manager.
2. Open your ClickUp MCP app.
3. Click OAuth Policies.
4. Revoke access, or delete the external client app.

Disconnecting in ClickUp revokes your OAuth token but leaves the external client app in Salesforce, so you can reconnect easily.

Security hardening for production (optional)

• Restrict by IP address: Add allowed IP ranges in OAuth Policies and check Enforce Refresh Token IP Allowlist under Security. Check that your MCP client's IP ranges fit within Salesforce's allowlist limits first.
• Single logout: Turn it on in Session Settings so ending a Salesforce session also ends the matching MCP session.
• Least privilege: Prefer SObject Reads unless your team needs to change records.