--- "@context": https://schema.org "@type": TechArticle "@id": https://www.twilio.com/docs/flex/admin-guide/setup/sso-configuration/salesforce#article headline: Configure Salesforce SSO with Flex description: Step-by-step instructions for setting up Salesforce single sign-on (SSO) with Twilio Flex as a SAML 2.0 identity provider, including certificate setup. url: https://www.twilio.com/docs/flex/admin-guide/setup/sso-configuration/salesforce inLanguage: en dateModified: 2026-10-12T13:24:12.000Z author: "@type": Organization name: Twilio Developer Education Team publisher: "@type": Organization name: Twilio --- # Configure Salesforce SSO with Flex Follow these steps to set up Salesforce single sign-on (SSO) in Twilio Flex. You'll need access to your Salesforce instance and permissions to configure it, as well as access to Twilio Console. > \[!NOTE] > > After configuring SSO in Flex, you can find your login link on the [**Single sign-on (SSO)** page](https://console.twilio.com/us1/develop/flex/users-and-access/single-sign-on) in Flex Console. ## Create a self-signed certificate in Salesforce 1. Follow [Salesforce's documentation to generate a self-signed certificate](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_creating.htm\&type=5). 2. When creating your certificate, leave the **Key Size** field set to **2048** and the **Exportable Private Key** option selected. These are the defaults. 3. Once you've downloaded your certificate, keep it available for later. You'll enter the contents of this file when you set up SSO in Flex. ## Enable Salesforce identity provider in Salesforce Follow [Salesforce's documentation to enable Salesforce as an IdP](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_enable.htm\&type=5) using the self-signed certificate you created in the previous section. ## Add Flex as an External Client App in Salesforce > \[!NOTE] > > Salesforce restricted the creation of new connected apps as of Spring 2026 and now recommends that you use External Client Apps. If you've already configured Flex as a connected app, it continues to work, but any new integrations should be created as External Client Apps. Follow [Salesforce's documentation to create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm\&type=5) for Twilio Flex, and then use the steps in the following sections to configure the app. ### Enter basic information Under **Basic Information**, enter the following information: 1. Set **External Client App Name** to **Twilio Flex**. 2. Set **API Name** to **Twilio\_Flex**. 3. In **Contact Email**, enter an email address. 4. Set **Distribution State** to **Local**. ### Configure SAML settings In the **Web App Settings (Enable SAML Settings)** section, enter the following information: 1. Select the **Enable SAML** checkbox. 2. Set **Entity Id** to the appropriate value for your [SSO configuration type](/docs/flex/admin-guide/setup/sso-configuration#enhanced-and-legacy-sso-configuration): * **Enhanced SSO configuration**:\ Copy this value from the **Set up your identity provider** page, which provides the specific value for your account. For example, `urn:flex:JQxxxx` * **Legacy SSO configuration**:\ Remember to replace `ACxxx` with your [Twilio Account SID](https://help.twilio.com/articles/14726256820123-What-is-a-Twilio-Account-SID-and-where-can-I-find-it-). Your value will look similar to this: `https://iam.twilio.com/v1/Accounts/ACxxxx/saml2/metadata` 3. Set **ACS URL** to the appropriate value for your [SSO configuration type](/docs/flex/admin-guide/setup/sso-configuration#enhanced-and-legacy-sso-configuration): * **Enhanced SSO configuration**:\ Copy the ACS URL value from the **Set up your identity provider** page, which provides the specific value for your account. Your value will look similar to this: `https://login.flex.us1.twilio.com/login/callback?connection=JQxxxx` * **Legacy SSO configuration**:\ Remember to replace `ACxxx` with your [Twilio Account SID](https://help.twilio.com/articles/14726256820123-What-is-a-Twilio-Account-SID-and-where-can-I-find-it-). Your value will look similar to this: `https://iam.twilio.com/v1/Accounts/ACxxxx/saml2` 4. Leave **Subject Type** as **Username**. This is the default. 5. Leave **Name ID Format** as `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`. This is the default. 6. Make sure **Issuer** is set to `https://YOUR_DOMAIN.my.salesforce.com/`, where YOUR\_DOMAIN is your Salesforce domain. This is the default. 7. Set **IdP Certificate** to the certificate you created in [Create a self-signed certificate in Salesforce](/docs/flex/admin-guide/setup/sso-configuration/salesforce#create-a-self-signed-certificate-in-salesforce). 8. Make sure **Verify request signatures** isn't selected. 9. Make sure **Encrypt SAML Response** isn't selected. 10. Click **Save**. ### Add custom attributes 1. In the same **Web App Settings** section, scroll to **Custom Attributes** and click **+** to add each of the following attributes: | Key | Value | | ---------- | -------------------------------------- | | full\_name | $User.FirstName + " " + $User.LastName | | roles | "agent" (must be in quotes) | > \[!NOTE] > > These attributes grant all users agent permissions in Flex. If you need to add `supervisor` or `admin` permissions, edit the "roles" custom attribute and include the roles as a comma-separated list. For example, "agent, supervisor, admin" grants users the `agent`, `supervisor`, and `admin` roles in Flex. ### Create a Salesforce user Follow [Salesforce's documentation to add a Salesforce user](https://help.salesforce.com/s/articleView?id=platform.adding_new_users.htm\&type=5) you can use to log in to Flex using SSO. Make sure to specify the following setting values: 1. In **User License**, select **Salesforce**. 2. In **Profile**, select **Standard User**. This ensures the user can access Flex. 3. Under **Approver Settings**, make sure **Generate new password and notify user immediately** is selected. ### Assign profile access to Flex To log in to Flex, Salesforce users must have a profile or permission set that's authorized for the Twilio Flex app. In the previous section, you assigned the user the Standard User profile. Follow these steps to give the Standard User profile access to the Twilio Flex app. 1. In Salesforce, from **Setup**, in the **Quick Find** box, enter **External Client App Manager**, and then select it. 2. Open the Twilio Flex app and go to **Policies**. 3. Under **App Policies**, add the Standard User profile to the authorized profiles. You can also authorize users with a permission set instead of a profile. > \[!WARNING] > > If you have Salesforce users with a different user profile who need to log in to Flex, you must assign Flex access to those profiles separately. Users assigned profiles without Flex access can't log in to Flex using SSO. ## Set up SSO in Flex After completing Salesforce setup, configure your Flex SSO connection to use Salesforce as the IdP. 1. In Twilio Console, navigate to **Flex** > **Users and access** > [**Single sign-on (SSO)**](https://console.twilio.com/us1/develop/flex/users-and-access/single-sign-on). 2. Set the **Friendly Name** to a recognizable name, like `SalesforceSSO`. 3. Copy the contents of the certificate you downloaded in [Create a self-signed certificate in Salesforce](/docs/flex/admin-guide/setup/sso-configuration/salesforce#create-a-self-signed-certificate-in-salesforce). 4. In **X.509 Certificate** field, paste the certificate contents. 5. Set **Identity Provider Issuer** to `https://.salesforce.com/`. 6. Set **SSO URL** to `https://.salesforce.com/idp/endpoint/HttpRedirect`. 7. Set **Default Redirect URL** to `https://.salesforce.com/idp/endpoint/HttpRedirect`. 8. Click **Save**. ## Testing SSO in Flex To test your Salesforce integration with Flex: 1. On the **Single Sign-On (SSO)** page, find the auto-generated login link. 2. Copy the link and paste it in your address bar.\ The browser redirects you to Salesforce. 3. Log in using your Salesforce credentials.\ After your credentials are authenticated, the browser redirects you back to Flex. This redirect indicates your SSO configuration is working.