Skip to main content
Tempo connects to Salesforce as your system of record. Opportunities, accounts, and contacts sync into Tempo, and Tempo proposes updates back to Salesforce with citations. Salesforce connects as a Connected App. A Salesforce Admin must approve the integration before users can authenticate.
Not using Salesforce? Tempo also connects to HubSpot, or you can import a CSV of your opportunities.

​
Two kinds of connection

Salesforce has two connection types in Tempo. They do different jobs. When an organization reader exists, the Connections page shows Connected for your organization on the Salesforce card. Each member still connects their own account. The card says why: Needed to write your edits back to Salesforce. Without an organization reader, each member’s personal connection also syncs that member’s deals until an admin connects the reader.

​
Common errors

If you see any of the following errors when attempting to log in, your Salesforce Admin has not yet granted access:
  • OAuth App Blocked
  • OAuth Error
  • OAUTH_APPROVAL_ERROR_GENERIC
To resolve this, work with your Salesforce Administrator or Operations team to complete the steps below.

​
Admin approval flow

1

Confirm Tempo is installed as a Connected App

In Salesforce, go to Setup → Apps → Connected Apps → Connected Apps OAuth Usage, find Tempo, and click Install.Connected Apps OAuth Usage in Salesforce showing Tempo installed
2

Configure user access

Once installed, click Manage App Policies and ensure Permitted Users is set to All users may self-authorize (default).OAuth Policies showing Permitted Users set to All users may self-authorize
Check the Refresh Token Policy while you are here. If it is set to immediately expire or to a very short window, users must re-authenticate often and may see connection errors. We recommend expire if not used for 14 days or longer.
3

Re-authenticate in Tempo

After policies are updated, users can log back into Tempo and authenticate with Salesforce.

​
Permissions

Tempo requests exactly two OAuth scopes: Tempo does not request openid, email, profile, or offline_access.
OAuth scopes do not decide which objects a user can read or write. That is controlled by the connected user’s Profile and Permission Sets in Salesforce. A user with a locked-down profile still gets permission errors on objects they cannot access. Diagnose those at the user or profile level.

​
What Tempo does with this access

  • Query and sync field definitions for Accounts, Contacts, and Opportunities
  • Sync a subset of Opportunities and their field values, selected during onboarding
  • For that subset, sync the related Account and Contact records
  • Write Opportunity field values to Salesforce when an update is approved, or when the field’s update behavior is Automatic
  • Create Opportunities, Accounts, and Contacts in Salesforce when a user creates them in Tempo

​
How writes to Salesforce work

Whether a field update reaches Salesforce without review depends on the update behavior set on each field: A person’s approval writes through that person’s personal connection, so Salesforce shows them as the editor. An organization admin who approves an update on a teammate’s deal needs their own personal connection. Two other write paths skip the review queue:
  • Record creation. New Opportunity in the Tempo app, and the create_crm_object tool over MCP, create the record in Tempo and queue an outbound create to Salesforce. There is no review step.
  • Per-user Automatic. When an admin turns on Allow per-user field settings, a seller can set a field to Automatic for their own deals.
Automatic apply skips closed opportunities and proposals generated only from artifacts older than 30 days. See Fields and CRM objects for the full rules.
Review which of your CRM-synced fields use Automatic before you describe Tempo’s write behavior in a security or governance review.

​
Not ready to connect?

If you cannot get admin approval right away, you can import a CSV of your opportunities and connect Salesforce later without losing anything.