Salesforce offers a unified platform for sales, service, marketing, and more—enabling teams to work smarter and serve customers better. Its cloud-first architecture and extensive ecosystem make it the go-to choice for modern customer engagement and business transformation.
MuleSoft is a leading integration platform that connects applications, data, and devices across cloud and on-premise environments.
It enables organizations to build scalable APIs and streamline communication between systems. With its Anypoint Platform, businesses can unlock data silos and accelerate digital transformation. MuleSoft empowers seamless, secure, and reusable integrations at enterprise scale.
Why MuleSoft is best choice for integrating systems with Salesforce
- Native Salesforce Connectivity: MuleSoft provides out-of-the-box connectors and templates tailored for Salesforce, making integration faster and more reliable.
- API-Led Architecture: Encourages modular, reusable APIs that allow scalable, maintainable, and secure integrations—perfect for evolving Salesforce ecosystems.
- Seamless Data Synchronization: Enables real-time and batch data sync between Salesforce and other systems, ensuring up-to-date and accurate customer information.
- Unified Anypoint Platform: A single platform for designing, building, deploying, and managing integrations across cloud and on-prem systems.
- Enhanced Security & Governance: Built-in policies, role-based access, and monitoring features ensure data protection and compliance throughout the integration lifecycle.
- Pre-built Accelerators: MuleSoft provides Salesforce-specific accelerators to jumpstart common integration use cases and reduce development time.
- Strong Ecosystem & Community Support: Backed by Salesforce (its parent company) and a global developer community, offering extensive documentation, support, and best practices.
Salesforce Connectors
In MuleSoft, several Salesforce connectors are available to support integration with different Salesforce products and features. Each connector is designed to target a specific Salesforce service or capability. Here’s a list of the most commonly used Salesforce connectors in MuleSoft:
1. Salesforce Connector
Purpose: Connects with the Salesforce Core platform (Sales/Service Cloud).
Supports: CRUD operations, SOQL/SOSL queries, Bulk API, Streaming API, Metadata API.
Use Cases: Account/contact sync, opportunity updates, Salesforce data integration with backend systems.
2. Salesforce Composite Connector
Purpose: Executes multiple REST API requests in a single call.
Supports: Composite API, Batch requests, Tree requests (insert parent-child records together)
Use Cases: Reducing API call limits, maintaining transaction integrity across multiple related operations.
3. Salesforce Analytics Connector (Einstein Analytics
Purpose: Connects to Tableau CRM / Einstein Analytics to retrieve datasets and insights.
Supports: Accessing analytics data, dashboards, datasets.
Use Cases: Embedding insights or visual data into integrated systems.
4. Salesforce Marketing Cloud Connector
Purpose: Integrates with Salesforce Marketing Cloud (SFMC).
Supports: Contact management, campaign data, data extensions, email sends, and tracking.
Use Cases: Personalized marketing, syncing customer data, automating campaigns from external systems.
5. Salesforce Commerce Cloud Connector
Purpose: Integrates with Salesforce B2C Commerce Cloud.
Supports: Access to product catalog, inventory, customer orders.
Use Cases: Syncing e-commerce data with ERP or fulfillment systems.
6. Salesforce Platform Events Connector
Purpose: Handles real-time event-driven integrations using Salesforce Platform Events.
Supports: Subscribing to platform events via CometD protocol.
Use Cases: Reacting to real-time Salesforce changes like case updates, lead creation, etc.
7. Salesforce Pub/Sub API Connector (newer)
Purpose: A modern replacement for Streaming API using gRPC-based Pub/Sub API.
Supports: Subscribing to high-throughput event streams (platform events, change data capture).
Use Cases: Real-time syncing at scale, more efficient than Streaming API.
Choosing the Right Connector:
| Connector Type | Use it when |
| Salesforce Connector | You need standard CRUD or query operations on Sales/Service Cloud. |
| Composite Connector | You need to optimize API usage or perform multiple operations in one call. |
| Analytics Connector | You want to retrieve or embed Salesforce Analytics data. |
| Marketing Cloud Connector | You need to manage email, contacts, and campaigns in SFMC. |
| Commerce Cloud Connector | You want to sync product or order data with e-commerce storefronts. |
| Platform Events Connector | You need real-time event-driven integration (CometD-based). |
| Pub/Sub API Connector | You need high-performance, scalable event handling (newer than CometD). |
Authentication Types available in MuleSoft Salesforce Connector
- Basic Authentication
- OAuth 2.0 Authentication
- OAuth JWT Authentication
- OAuth Client Credentials Authentication
- OAuth SAML Authentication
- OAuth Username Password Authentication
1. Basic Authentication
Description:
Uses a Salesforce username and password (and optionally a security token) to authenticate directly with Salesforce.
When to Use:
– For quick testing, development, or low-risk internal systems.
– When security policies are relaxed or temporary access is needed.
2. OAuth 2.0 Authentication
Description:
Delegates authentication to Salesforce by redirecting the user to log in, then grants the app access via an authorization code.
When to Use:
– In interactive applications (web/mobile) where users log in directly.
– When granular user consent is required.
3. OAuth JWT Authentication
Description:
Uses a signed JWT token with client credentials and a certificate (or JKS) to request an access token without user interaction.
When to Use:
– Ideal for server-to-server communication.
– Recommended for secure, automated backend integrations.
4. OAuth Client Credentials Authentication
Description:
Uses only the client ID and client secret to authenticate and obtain an access token on behalf of the client.
When to Use:
– For machine-to-machine integrations with no user context.
– For accessing public or organizational-level APIs.
5. OAuth SAML Authentication
Description:
Uses a signed SAML 2.0 assertion to request an access token from Salesforce.
When to Use:
– When using SAML-based Single Sign-On (SSO).
– In enterprise environments with federated identity providers.
6. OAuth Username Password Authentication
Description:
A hybrid approach that uses OAuth 2.0, but instead of redirecting users, it directly sends username, password, client ID, and client secret to obtain an access token.
When to Use:
– For automated systems where user login is not feasible.
– In trusted backend services that need user-level access.
For information about configuring these authentication types, see Using Anypoint Studio to Configure Salesforce Connector.
Integration Patterns Between MuleSoft & Salesforce
When integrating Salesforce with other systems via MuleSoft, it’s important to adopt the right pattern for your business case. Below are some of the most common patterns, along with examples, best connectors to use, and design principles to follow.
Real-Time Request-Response (Synchronous Operations)
Use Case: Immediate read or write to Salesforce based on external system events or user actions.
Example:
- A user submits a form on a website, and a new Contact is instantly created in Salesforce.
- A mobile app requests real-time customer information from Salesforce to display on the UI.
Best Connector:
- Standard Salesforce Connector (with REST or SOAP APIs)
When to Use:
- External system (or UI) needs immediate response from Salesforce.
- You are reading or writing Salesforce records synchronously, e.g., on form submission.
- Use for validations, record lookups, or single-object updates.
- Especially useful when user-facing systems (like apps or portals) require instant interaction with Salesforce.
Best Practices:
- Ensure low-latency design — limit heavy transformations in the main flow.
- Use caching (e.g., object metadata) to avoid frequent metadata API calls.
- Implement timeouts and fallback logic to handle Salesforce service disruptions.
- Monitor Salesforce API limits to avoid hitting governor limits in high-volume use cases.
Real-Time Sync
Use Case: Instantly update a downstream system (e.g., database, ERP) when a record is created or modified in Salesforce.
Example: A new Lead created in Salesforce should immediately reflect in a marketing system or some other database.
Best Connector:
- Salesforce Platform Events Connector
- Salesforce Pub/Sub API Connector (for higher throughput, lower latency)
When to Use:
- You need to push updates instantly from Salesforce to external systems.
- A downstream system must react immediately to changes in Salesforce (e.g., a new Case, Lead, or Opportunity).
- You require event-driven architecture for loosely coupled integrations.
- Use when high-frequency, low-latency communication is a requirement.
Best Practices:
- Use Event-Driven Architecture to decouple services.
- Ensure proper error handling to avoid event loss.
- Implement acknowledgement or replay logic (Pub/Sub API supports this).
- Avoid unnecessary transformations in the real-time path — keep it lean.
Batch Data Migration or Sync
Use Case: Migrate or sync large volumes of data between Salesforce and external systems.
Example: Nightly batch job to sync customer records from Salesforce to an enterprise data warehouse (e.g., Snowflake).
Best Connector:
- Salesforce Connector with Bulk API v2 enabled
When to Use:
- You’re dealing with large volumes of data (tens of thousands to millions of records).
- Periodic syncs are sufficient (e.g., nightly or hourly jobs).
- Real-time sync is not required or not cost-effective.
- During initial data migration from legacy systems to Salesforce.
- Suitable for data lakes, reporting platforms, or backup archives.
Best Practices:
- Use Batch Scope in MuleSoft to chunk data.
- Enable pagination and chunking for large datasets.
- Avoid peak Salesforce API usage times.
- Monitor API limits using MuleSoft’s metrics and implement retry/backoff logic.
API Orchestration with Composite API
Use Case: Perform multiple related Salesforce operations in a single API call.
Example: When a new Account is created, create multiple related Contacts and a custom object in one transaction.
Best Connector:
- Salesforce Composite Connector
When to Use:
- You want to perform multiple related API operations (e.g., create parent and child records) in a single HTTP call.
- You need transactional consistency – all changes must succeed or none at all.
- To reduce API callouts from mobile apps or front ends (improves performance).
- When building Experience APIs that hide system complexity from consumers.
Best Practices:
- Ideal for reducing round trips and improving performance.
- Ensure transactional integrity — all operations succeed or fail together.
- Useful for mobile or front-end calls to minimize latency.
- Maintain JSON request structure as per Salesforce composite API expectations.
Event-Driven Integrations with Pub/Sub or Webhooks
Use Case: Notify external systems about changes in Salesforce asynchronously.
Example: When a case is updated in Salesforce, trigger a notification in Slack or a record update in ServiceNow.
Best Connector:
- Salesforce Pub/Sub API Connector – Modern, scalable option for real-time events.
- Salesforce Connector with Change Data Capture (CDC) or Platform Events
When to Use:
- You want near real-time event delivery without polling.
- External systems need to subscribe to changes happening in Salesforce.
- Ideal for microservices, messaging-based systems, and decoupled architectures.
- You want to scale horizontally while maintaining loose coupling.
Best Practices:
- Use non-blocking flows for downstream processing.
- Leverage CloudHub queues or Persistent Queues to manage event spikes.
- Use Anypoint MQ or Kafka connectors downstream for distributed systems.
- Implement dead-letter queues or retry mechanisms for failed messages.
Design Principles to Follow Across Patterns:
- Secure Integration: Use OAuth-based authentication over Basic Auth whenever possible.
- Idempotency: Ensure repeated events don’t result in duplicate records or operations.
- Observability: Use custom logging, correlation IDs, and alerts for traceability.
- Reusability: Design flows using API-led architecture (System APIs, Process APIs, Experience APIs).
- Governance: Use API Manager to apply throttling, SLAs, and security policies.
Security & Best Practices for MuleSoft–Salesforce Integrations
When integrating with Salesforce, it’s essential to follow security and operational best practices to ensure a secure, reliable, and scalable integration architecture.
Token Storage & Refresh
Why it matters: Many Salesforce authentication flows (like OAuth 2.0) provide a short-lived access token. Without proper token handling, your integration will break once the token expires.
Best Practices:
- Use Object Store in MuleSoft to store access and refresh tokens securely.
- Implement a token refresh flow that triggers automatically when a 401 Unauthorized error is returned.
- Avoid storing sensitive tokens in plain text or logs.
Handling Expired Sessions or Token Failures
Why it matters: Tokens or sessions may expire due to timeout, manual revocation, or policy changes.
Best Practices:
- Use On Error Continue/Propagate with specific handling for 401 and 403 HTTP status codes.
- Build custom retry logic that first attempts token renewal, then retries the original request.
- Implement circuit breakers to avoid overwhelming downstream services during failures.
Retry Strategies & Rate Limiting
Why it matters: Salesforce has strict API usage limits (per user, per org). Hitting these can block integrations.
Best Practices:
- Implement exponential backoff in retry logic for transient failures.
- Monitor API consumption via Salesforce Limits API and log usage.
- Use API Throttling Policies in Anypoint API Manager to protect against spikes.
- Segment heavy-lifting operations using Batch Jobs to avoid hitting limits during peak load.
Data Transformation Best Practices (DataWeave)
Why it matters: Transforming data accurately and efficiently ensures smooth data flow between systems with different formats and structures.
Best Practices:
- Use DataWeave modules (e.g., dw::core::Strings, dw::core::Dates) for clean, readable transformations.
- Keep complex transformations modular by separating logic into external DataWeave (.dwl) files.
- Use output application/json skipNullOn=”everywhere” to produce clean payloads.
- Handle null checks and optional fields explicitly to avoid runtime errors.
- Use Logger components strategically to debug transformations, but avoid logging sensitive data.
Additionally, When you’re exposing MuleSoft APIs for Salesforce to consume (for outbound integration), it’s essential to apply strong security policies to protect your APIs and data. Below are some key policies to implement:
- OAuth 2.0
- Enforce token-based authentication to ensure only authorized systems or users can access your APIs securely.
- IP Whitelisting
- Restrict access to your APIs by allowing only trusted IP ranges, such as those used by Salesforce, to reduce exposure.
- CORS (Cross-Origin Resource Sharing)
- Enable CORS to control which external domains can call your APIs from the browser or Salesforce’s front-end services.
- Rate Limiting
- Prevent abuse and protect backend systems by limiting the number of requests allowed from a single source over a defined period.
These policies can be easily applied using API Manager in Anypoint Platform and are critical to ensuring your integration is secure, resilient, and scalable.