n8n-nodes-crm

A custom n8n community node package that provides a Salesforce CRM node with per-project credential resolution. It is forked directly from the n8n built-in Salesforce node and exposes the same operations and UI — the only thing that changes is how credentials are supplied.

What this node is

The Salesforce CRM node (salesforceCrm) is identical to the built-in salesforce node in every functional respect: same resources, same operations, same UI fields. The difference is the credential system:

| Built-in Salesforce node | This node | |---|---| | Requires OAuth2 redirect/callback flow or JWT | No OAuth redirect — credentials resolved at runtime | | One credential entry shared by all workflows | One credential entry per project | | SF keys stored directly in n8n credential | Real SF keys stored in env vars, Vault, or SSM | | Authentication selector visible in node UI | Authentication is transparent to the user |

How it works

1. You create one Salesforce CRM (Project) credential for each Salesforce org or project (e.g. p1, p2, p3).
2. The credential stores a projectId and your choice of secrets backend (env, vault, or ssm).
3. When a workflow runs, the node fetches the real Salesforce credentials (client ID, secret, username, password, instance URL) from the chosen backend and exchanges them for an OAuth2 access token via the Salesforce password-grant flow.
4. No access tokens are ever stored in n8n.

Getting started

npm install
npm run dev   # starts n8n at http://localhost:5678 with your node loaded

Creating a credential — one per project

In n8n, go to Credentials → New → Salesforce CRM (Project) and fill in:

| Field | Example | |---|---| | Project ID | p1 | | Secrets Backend | Environment Variables |

Environment variable backend

With backend set to env and prefix SF, these variables must be set before starting n8n:

export SF_P1_CLIENT_ID=...
export SF_P1_CLIENT_SECRET=...
export [email protected]
export SF_P1_PASSWORD=yourpassword+securitytoken
export SF_P1_INSTANCE_URL=https://yourorg.my.salesforce.com

The variable names follow the pattern {PREFIX}_{PROJECT_ID_UPPERCASED}_*. For project my-org with prefix SF the names become SF_MY_ORG_*.

Adding a new project

Create a new Salesforce CRM (Project) credential entry with a different Project ID (e.g. p2). Set the corresponding env vars (or Vault/SSM entries). No code changes required.

HashiCorp Vault backend

Set backend to HashiCorp Vault and fill in:

| Field | Example | |---|---| | Vault Address | https://vault.internal:8200 | | Vault Token | s.xxxxxx | | Vault Path | salesforce/p1 (or salesforce/{projectId}) |

The secret at that path must be a KV v2 secret with these keys:

{
  "clientId": "...",
  "clientSecret": "...",
  "username": "...",
  "password": "...",
  "instanceUrl": "https://yourorg.my.salesforce.com"
}

AWS SSM Parameter Store backend

Set backend to AWS SSM and fill in:

| Field | Example | |---|---| | AWS Region | us-east-1 | | AWS Access Key ID | (leave blank to use instance role) | | AWS Secret Access Key | (leave blank to use instance role) | | SSM Path | /salesforce/p1 (or /salesforce/{projectId}) |

Parameters under that path (fetched with GetParametersByPath) must have these names:

/salesforce/p1/client_id
/salesforce/p1/client_secret
/salesforce/p1/username
/salesforce/p1/password
/salesforce/p1/instance_url

All parameters should be SecureString type. WithDecryption: true is set automatically.

Supported resources and operations

Identical to the built-in Salesforce node:

| Resource | Operations | |---|---| | Account | Create, Delete, Get, Get All, Update | | Attachment | Create, Delete, Get, Get All, Update | | Case | Create, Delete, Get, Get All, Update | | Contact | Create, Delete, Get, Get All, Update | | Custom Object | Create, Delete, Get, Get All, Update | | Document | Upload | | Flow | Get All, Invoke | | Lead | Create, Delete, Get, Get All, Update, Add to Campaign, Convert | | Opportunity | Create, Delete, Get, Get All, Update | | Search | Query | | Task | Create, Delete, Get, Get All, Update | | User | Get, Get All |

Known limitations

• The Salesforce API Version credential field (sfApiVersion) is stored but currently not applied — the API version is pinned to 59.0 in the underlying request builder. Change the source if you need a different version.

Publishing

npm run release   # bumps version, creates git tag, triggers GitHub Action to publish to npm

The publish workflow is inherited from the n8n-nodes-starter template.

License

MIT