How to Integrate Lovable with Propertybase

In your Propertybase/Salesforce org, navigate to Setup (gear icon → Setup). In the Quick Find box, search for 'App Manager'. Click 'New Connected App'. Fill in the required fields: Connected App Name (e.g., 'Lovable Integration'), API Name (auto-populated), Contact Email, and check 'Enable OAuth Settings'. In the OAuth settings section, add a Callback URL (required but not used for username-password flow — use https://localhost/callback as a placeholder). For OAuth Scopes, add 'Access and manage your data (api)' and 'Perform requests on your behalf at any time (refresh_token, offline_access)'. Save the Connected App. After saving, Salesforce generates a Consumer Key (client ID) and Consumer Secret (client secret). These are the credentials your Edge Function will use to authenticate. Navigate back to the Connected App and click 'Manage' → 'Edit Policies'. Set 'Permitted Users' to 'All users may self-authorize' or 'Admin approved users are pre-authorized' depending on your security requirements. For the Lovable Edge Function, also consider setting 'IP Relaxation' to 'Relax IP restrictions' so the function can authenticate from any IP. Note: Salesforce may require 10-15 minutes for the Connected App to propagate before the OAuth credentials work. Also retrieve your Salesforce security token (Setup → Personal Settings → Reset My Security Token) — you may need to append it to your password in the OAuth request.

In Lovable, click the '+' button next to the Preview panel to open the Cloud tab, then navigate to Secrets. Add these secrets: - SALESFORCE_CLIENT_ID: the Connected App's Consumer Key - SALESFORCE_CLIENT_SECRET: the Connected App's Consumer Secret - SALESFORCE_USERNAME: your Salesforce username (email address format) - SALESFORCE_PASSWORD: your Salesforce password - SALESFORCE_SECURITY_TOKEN: your Salesforce security token (separate from password for flexibility) - SALESFORCE_INSTANCE_URL: your Salesforce org's instance URL (e.g., https://myorg.my.salesforce.com) The SALESFORCE_INSTANCE_URL is important — it determines which Salesforce server handles your API requests. Find it in Salesforce Setup → Company Information or simply by looking at the URL in your browser when logged into Salesforce. For Propertybase orgs using Salesforce sandbox environments during development, use the sandbox login URL (https://test.salesforce.com instead of https://login.salesforce.com) and sandbox-specific credentials. Add separate secrets for sandbox vs production and use them in the appropriate Lovable project.

Create the Edge Function that handles Salesforce OAuth2 authentication and Propertybase API calls. The username-password OAuth flow sends a POST to https://login.salesforce.com/services/oauth2/token with grant_type=password, client_id, client_secret, username, and password (with security token appended). A successful OAuth response returns an access_token, instance_url, and token_type. The access token is valid for the duration of the session (configurable in Salesforce, typically several hours). Store it in a module-level cache with its expiry to avoid re-authenticating on every request. With the access token, Salesforce REST API calls use the standard format: GET {instance_url}/services/data/v58.0/query/?q=SELECT+Id,Name+FROM+pb__Listing__c. The SOQL (Salesforce Object Query Language) SELECT statement specifies the fields and objects. Propertybase's custom objects have the pb__ namespace prefix on both the object name (pb__Listing__c) and field names (pb__List_Price__c). Ask Lovable to generate the Edge Function with cached authentication and a flexible SOQL query interface so you can add new queries without deploying new functions.

1// Key section of propertybase-proxy authentication:
2// supabase/functions/propertybase-proxy/index.ts
3
4let cachedToken: string | null = null;
5let tokenExpiry: number = 0;
6
7async function getSalesforceToken(): Promise<string> {
8  if (cachedToken && Date.now() < tokenExpiry) return cachedToken;
9
10  const params = new URLSearchParams({
11    grant_type: "password",
12    client_id: Deno.env.get("SALESFORCE_CLIENT_ID") || "",
13    client_secret: Deno.env.get("SALESFORCE_CLIENT_SECRET") || "",
14    username: Deno.env.get("SALESFORCE_USERNAME") || "",
15    password: (Deno.env.get("SALESFORCE_PASSWORD") || "") + (Deno.env.get("SALESFORCE_SECURITY_TOKEN") || ""),
16  });
17
18  const response = await fetch("https://login.salesforce.com/services/oauth2/token", {
19    method: "POST",
20    headers: { "Content-Type": "application/x-www-form-urlencoded" },
21    body: params,
22  });
23
24  if (!response.ok) {
25    const error = await response.json();
26    throw new Error(`Salesforce auth failed: ${error.error_description}`);
27  }
28
29  const data = await response.json();
30  cachedToken = data.access_token;
31  tokenExpiry = Date.now() + 7200000; // 2 hours
32  return cachedToken;
33}

With authentication working, open Lovable chat and describe the broker dashboard components. Provide the SOQL queries you want to run and the Propertybase object field names — Lovable generates React components that call the Edge Function with the appropriate queries. SOQL queries for a typical Propertybase dashboard: active listings count uses SELECT COUNT() FROM pb__Listing__c WHERE pb__Status__c = 'Active', pending transactions uses SELECT Id, pb__Property_Address__c, pb__Contract_Price__c FROM pb__Transaction__c WHERE pb__Transaction_Status__c = 'Pending', and recent closed volume uses SELECT SUM(pb__Contract_Price__c) totalVolume FROM pb__Transaction__c WHERE pb__Closed_Date__c = THIS_MONTH AND pb__Transaction_Status__c = 'Closed'. Salesforce's SOQL date literals (THIS_MONTH, LAST_MONTH, THIS_YEAR, LAST_N_DAYS:30) are very useful for dashboard metrics — include them in your prompts so Lovable uses them in the generated queries rather than calculating dates manually. Be careful with SOQL injection: never build SOQL queries by concatenating user input. All user-provided values should be escaped or, better, use Salesforce's query by Id pattern rather than filtering by user-provided strings. For dashboards where the user selects from a dropdown of predefined options, construct SOQL server-side in the Edge Function based on the selected option key.

Beyond listings and transactions, Propertybase's core CRM value is lead and contact management. Adding lead intake forms that create Salesforce Lead records, contact lookup, and lead status update capabilities transforms a read-only dashboard into a fully functional CRM interface. Creating a Salesforce record uses a POST request to the CRUD endpoints rather than the query endpoint. The Salesforce REST API CRUD endpoints follow the pattern: POST {instance_url}/services/data/v58.0/sobjects/{ObjectName}/ with the field values as a JSON body. For Propertybase leads, POST to /sobjects/Lead/ with required standard Lead fields (LastName, Company) plus any Propertybase custom fields. Update operations use PATCH to /sobjects/{ObjectName}/{recordId} with only the changed fields. Lovable can generate update forms that pre-fill with current values fetched via SOQL and submit only the modified fields in the PATCH request. For complex broker workflows involving Salesforce Process Builder automations or custom lead routing logic already configured in Propertybase, RapidDev's team can help ensure Lovable's API calls trigger the correct automated workflows.