How to Integrate Lovable with Salesforce

Salesforce's JWT bearer flow requires you to sign JWTs with an RSA private key and register the corresponding public key in your Connected App. You need to generate this key pair before setting up the Connected App in Salesforce. The most secure way to generate RSA keys is using OpenSSL in a terminal, but since this guide targets browser-only workflows, you can use an online RSA key generator at a trusted site like cryptotools.net or generate-random.org/rsa-key-generator. Use 2048-bit key size minimum. The output will be two blocks: a private key (starting with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN PRIVATE KEY-----) and a public key (starting with -----BEGIN PUBLIC KEY----- or -----BEGIN CERTIFICATE-----). To create a self-signed certificate (which is what Salesforce requires for the Connected App): the certificate is essentially the public key wrapped in X.509 format. If you used a standard RSA key generator, you may need to also create a certificate. A simpler approach: use jwt.io's key generator, or use an online X.509 certificate generator with your public key. Copy both the full private key PEM text (everything including the -----BEGIN...----- and -----END...----- headers) and the certificate/public key text. You will paste the private key into Lovable's Secrets panel and upload the certificate to Salesforce's Connected App. Store the private key content carefully — it is the equivalent of a password. Never share it or commit it to any repository.

A Connected App in Salesforce represents your Lovable integration and defines its authentication method and API permissions. Setting it up correctly is the most involved part of the Salesforce integration. Log in to Salesforce Setup: click the gear icon in the top navigation → Setup. In the Quick Find search box, type 'App Manager' and select 'App Manager' under Apps. Click 'New Connected App' in the top-right corner. Fill in the Basic Information section: - Connected App Name: Lovable Integration (or a descriptive name) - API Name: auto-fills from the name - Contact Email: your email address In the API (Enable OAuth Settings) section: - Check 'Enable OAuth Settings' - Callback URL: https://localhost:3000 (required even for JWT-only apps) - Check 'Use digital signatures' — this enables JWT authentication - Upload your X.509 certificate file (the public key/certificate from Step 1) - Selected OAuth Scopes: add 'Manage user data via APIs (api)' and 'Perform requests at any time (refresh_token, offline_access)' Click Save. Salesforce may take a few minutes to activate the Connected App. After it is active, find the Connected App in App Manager and click 'View'. Note the Consumer Key (also called Client ID) — this is your SALESFORCE_CONSUMER_KEY secret value. Finally, you need to pre-authorize the API user: in Setup → Manage Connected Apps → your app → Manage → Edit Policies, set IP Relaxation to 'Relax IP restrictions' and in Permitted Users, set to 'Admin approved users are pre-authorized'. Then go to Setup → Users → your API user → Permission Sets and assign the Connected App permission set to that user.

Store your Salesforce credentials in Cloud Secrets. The RSA private key is particularly sensitive — it signs JWT tokens that grant API access to your Salesforce CRM data. In Lovable, click '+' next to the Preview label → Cloud panel → Secrets tab. Add the following secrets: SALESFORCE_CONSUMER_KEY: the Consumer Key from your Connected App (a long alphanumeric string) SALESFORCE_PRIVATE_KEY: the full RSA private key PEM content, including the -----BEGIN RSA PRIVATE KEY----- header and -----END RSA PRIVATE KEY----- footer. When pasting multi-line content into the secrets panel, paste the entire block. SALESFORCE_USERNAME: the Salesforce username (email) of the API user that will make the API calls. This user must be pre-authorized for the Connected App as configured in Step 2. SALESFORCE_INSTANCE_URL: your Salesforce instance URL (e.g., https://mycompany.my.salesforce.com for production, or https://mycompany--sandbox.sandbox.my.salesforce.com for sandbox). With these four secrets, your Edge Function has everything needed to generate and sign a JWT, exchange it for a Salesforce access token, and make API calls.

Create the Edge Function that handles JWT token generation and Salesforce REST API calls. The JWT bearer flow has three steps: generate a JWT assertion, POST it to Salesforce's token endpoint, and use the returned access token for subsequent API calls. In Deno, JWT signing uses the WebCrypto API (crypto.subtle.sign) with the RSA-PSS or PKCS#1 v1.5 algorithm. Deno's crypto module supports RSA signing natively without third-party libraries. The signed JWT payload must include: iss (your consumer key), sub (the Salesforce username), aud (login.salesforce.com or test.salesforce.com for sandbox), and exp (expiry timestamp, max 5 minutes from now). After authentication, Salesforce REST API calls use the Bearer token pattern. SOQL queries use the /services/data/vXX.X/query endpoint with the SOQL string URL-encoded as a q parameter. Create, update, and delete operations use the /services/data/vXX.X/sobjects/{ObjectType} endpoints. The Edge Function below shows the complete JWT generation, token exchange, and a sample SOQL query. Deno's Web Crypto API handles RSA signing natively, so no npm packages are needed for the JWT signing step.

1import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
2
3const corsHeaders = {
4  'Access-Control-Allow-Origin': '*',
5  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
6}
7
8function base64UrlEncode(buffer: ArrayBuffer): string {
9  return btoa(String.fromCharCode(...new Uint8Array(buffer)))
10    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
11}
12
13async function getSalesforceToken(
14  consumerKey: string,
15  privateKeyPem: string,
16  username: string,
17  isSandbox = false
18): Promise<{ accessToken: string; instanceUrl: string }> {
19  const audience = isSandbox
20    ? 'https://test.salesforce.com'
21    : 'https://login.salesforce.com'
22
23  const now = Math.floor(Date.now() / 1000)
24  const header = { alg: 'RS256', typ: 'JWT' }
25  const payload = { iss: consumerKey, sub: username, aud: audience, exp: now + 300 }
26
27  const encodedHeader = base64UrlEncode(new TextEncoder().encode(JSON.stringify(header)))
28  const encodedPayload = base64UrlEncode(new TextEncoder().encode(JSON.stringify(payload)))
29  const signingInput = `${encodedHeader}.${encodedPayload}`
30
31  // Import RSA private key
32  const pemContent = privateKeyPem
33    .replace(/-----BEGIN (RSA )?PRIVATE KEY-----/, '')
34    .replace(/-----END (RSA )?PRIVATE KEY-----/, '')
35    .replace(/\s/g, '')
36  const keyBuffer = Uint8Array.from(atob(pemContent), (c) => c.charCodeAt(0))
37
38  const cryptoKey = await crypto.subtle.importKey(
39    'pkcs8',
40    keyBuffer,
41    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
42    false,
43    ['sign']
44  )
45
46  const signature = await crypto.subtle.sign(
47    'RSASSA-PKCS1-v1_5',
48    cryptoKey,
49    new TextEncoder().encode(signingInput)
50  )
51
52  const jwtAssertion = `${signingInput}.${base64UrlEncode(signature)}`
53
54  const tokenResponse = await fetch(`${audience}/services/oauth2/token`, {
55    method: 'POST',
56    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
57    body: new URLSearchParams({
58      grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
59      assertion: jwtAssertion,
60    }),
61  })
62
63  const tokenData = await tokenResponse.json()
64  if (!tokenResponse.ok) {
65    throw new Error(`Salesforce auth failed: ${tokenData.error}: ${tokenData.error_description}`)
66  }
67
68  return { accessToken: tokenData.access_token, instanceUrl: tokenData.instance_url }
69}
70
71serve(async (req) => {
72  if (req.method === 'OPTIONS') {
73    return new Response('ok', { headers: corsHeaders })
74  }
75
76  try {
77    const { soql } = await req.json()
78
79    const consumerKey = Deno.env.get('SALESFORCE_CONSUMER_KEY')!
80    const privateKey = Deno.env.get('SALESFORCE_PRIVATE_KEY')!
81    const username = Deno.env.get('SALESFORCE_USERNAME')!
82    const isSandbox = Deno.env.get('SALESFORCE_INSTANCE_URL')?.includes('sandbox') ?? false
83
84    if (!consumerKey || !privateKey || !username) {
85      throw new Error('Missing Salesforce secrets')
86    }
87
88    const { accessToken, instanceUrl } = await getSalesforceToken(
89      consumerKey, privateKey, username, isSandbox
90    )
91
92    const queryUrl = `${instanceUrl}/services/data/v58.0/query?q=${encodeURIComponent(soql)}`
93    const queryResponse = await fetch(queryUrl, {
94      headers: { Authorization: `Bearer ${accessToken}` },
95    })
96
97    const queryData = await queryResponse.json()
98    if (!queryResponse.ok) {
99      throw new Error(`Salesforce query failed: ${JSON.stringify(queryData)}`)
100    }
101
102    return new Response(
103      JSON.stringify({ records: queryData.records, totalSize: queryData.totalSize }),
104      { headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
105    )
106  } catch (error) {
107    return new Response(
108      JSON.stringify({ error: error.message }),
109      { status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
110    )
111  }
112})