Connect a Salesforce org

Before you begin

Your Org Loom sign-in and Salesforce sign-in are separate. Connecting an org authorizes one Salesforce user. Org Loom follows that user's object permissions, field-level security, sharing rules, and record access for every Salesforce operation.

You will need:

• The login details for the Salesforce user you want to connect.
• A Salesforce administrator for the first connection to an org, or an administrator who can complete the setup request Org Loom prepares.
• The org's Current My Domain URL when you use the Custom URL option. Find it under Salesforce Setup → Company Settings → My Domain.

Org Loom never receives the Salesforce password entered on the Salesforce sign-in page. The connection is temporary and can require a fresh Salesforce sign-in after the session expires or the service restarts.

The process

1. Open Your Salesforce orgs from the canvas.
2. Choose Production, Sandbox, or Custom URL.
3. Sign in on Salesforce and approve access.
4. Install the managed package if the org does not have it.
5. Confirm the Org Loom OAuth IP policy.
6. Assign the Org Loom permission set if your user is missing it.
7. Return to the canvas and confirm the connected identity.

Step 1: Open the Salesforce connection window

On a new canvas, select Connect Salesforce in the getting-started guide. You can also select the Not connected Salesforce control in the top-right area of the app at any time.

This opens Your Salesforce orgs without requiring you to leave the canvas first.

Step 2: Choose the correct sign-in address

• Production / Developer Edition starts at Salesforce's standard production login.
• Sandbox starts at Salesforce's sandbox login.
• Custom URL signs in through a specific My Domain. Use it for scratch orgs, My-Domain-only orgs, or whenever your organization requires its own sign-in address. Org Loom adds https:// if you leave it out.

For Custom URL, use the Salesforce domain, not a URL copied from a specific record or Setup page. A domain such as acme.my.salesforce.com is sufficient.

Step 3: Sign in and approve access

Salesforce opens its own sign-in page. Check the displayed domain and enter the credentials for the intended Salesforce user. If the browser already has a Salesforce session, confirm that Salesforce has not selected a different user automatically.

When Salesforce displays Allow Access?, review the request and select Allow.

Step 4: Install Org Loom when prompted

If the org does not have the managed package, Org Loom opens Install Org Loom in your Salesforce org. The package provides the Salesforce components used to save canvases, protect canvas encryption keys, record data activity, and grant package access.

If you are the Salesforce administrator:

1. Confirm the target org and select Install Org Loom in Salesforce.
2. On the Salesforce package page, choose Install for All Users.
3. Approve the third-party access request and select Install.
4. Wait for Salesforce to report that the installation is complete.

If you are not the administrator, use the Not the Salesforce admin? section to copy or email the prepared request. Keep the Org Loom page open while the admin completes the work.

Step 5: Confirm the OAuth IP policy

After installing the package, the Salesforce administrator must:

1. Open External Client App Manager in Salesforce Setup.
2. Find Org Loom and open Edit Policies.
3. Set IP Relaxation to Relax IP restrictions and save.

This setting applies to the Org Loom OAuth app. It does not remove the org's network rules or the profile restrictions used for normal Salesforce sign-ins.

Back in Org Loom, select the confirmation that the package and policy are ready, then choose Setup is complete, sign me in.

Need to enforce IP restrictions? Your administrator can keep the policy restricted and allowlist Org Loom's hosted egress ranges instead. Contact support@orgloom.com for the current ranges and change-notification process.

Step 6: Assign the permission set when prompted

The person who installs the managed package receives the packaged Org Loom Admin permission set automatically. Other users need a direct assignment of Org Loom User, or Org Loom Admin when they are responsible for managing other people's saved canvases.

Every connecting user also needs Salesforce’s API Enabled system permission through their profile or a separate permission set. Salesforce does not carry that standard system permission in the installed managed permission sets.

Org Loom verifies the packaged assignment for every user, including a Salesforce System Administrator. Profile permissions alone do not replace this check.

1. Select Open Salesforce user record.
2. Under Permission Set Assignments, select Edit Assignments and add the packaged permission set.
3. Save the assignment.
4. Return to Org Loom and choose Check permission and continue.

If you cannot edit your own Salesforce user, send the prepared request to an administrator. Assign the permission set directly rather than through a permission-set group so Org Loom can verify it.

Step 7: Confirm the connection

After the final Salesforce sign-in, Org Loom returns to the canvas. The Salesforce control shows the connected username and the getting-started guide enables its record actions.

Check that the displayed Salesforce user and org are the ones you intended before adding or changing records.

Reconnect after a Salesforce session ends

When a Salesforce action finds that the session has ended, Org Loom shows Your Salesforce session ended. Choose:

• Sign in again to reconnect to the current org.
• Sign in to a different org to open the connection list.
• Keep working offline to continue arranging and editing the canvas without Salesforce reads or writes.

You can also select the Salesforce connection control and choose Open beside a saved org. Open always starts a fresh Salesforce sign-in for that connection.

Use more than one Salesforce org

Open Your Salesforce orgs, expand Connect another Salesforce org, and complete the same process for the additional org. Each org needs its own package, OAuth policy, and user permission-set assignments.

The current connection is marked Active. Select Open on another row and sign in to make that user and org active. When your purpose is to move records between orgs, use the guided cross-org migration instead of changing connections manually.

Remove a saved connection

Select Remove beside a saved Salesforce org and confirm. Removing the active connection also clears its current Salesforce session. You can add it again later by signing in.

Removing a connection does not delete Salesforce records, saved canvases, or activity stored in Salesforce. Signing out of Org Loom also ends the current sessions, but it does not remove the saved org entries from your account.

If Salesforce cannot complete the connection

An expired or previously used authorization code can fail once and succeed on a fresh attempt. Choose Retry Salesforce sign-in. If the failure repeats, ask a Salesforce administrator to confirm the Org Loom IP Relaxation policy described above.

For scratch orgs and My-Domain-only orgs, return to Your Salesforce orgs and use Custom URL with the org's Current My Domain URL.

See also

• Quick start
• Building and uploading a canvas
• Moving records to another org
• Troubleshooting