n8n Salesforce Integration: The Complete Self-Hosted Automation Guide

Disclosure: This post contains one or more links to providers we have a real, registered affiliate/referral relationship with. We may earn a commission at no extra cost to you if you sign up through them.

If you’re tired of paying per-task fees to Zapier or Make just to move records between Salesforce and the rest of your stack, an n8n Salesforce integration solves that problem without a subscription ceiling. n8n is an open-source, node-based workflow automation tool you can self-host, and its Salesforce node covers most of what teams actually need: syncing leads, updating opportunities, triggering notifications, and keeping downstream systems in sync with your CRM.

This guide walks through deploying n8n with Docker, authenticating against Salesforce with OAuth2, and building working automation examples you can adapt immediately.

Why Automate Salesforce with n8n

Salesforce is powerful but notoriously clunky to extend without paying for additional platform licenses (Flow limits, API call caps, Process Builder complexity). n8n sits outside Salesforce entirely, talking to it through the Salesforce REST API, which means you can:

Sync leads from a website form, Stripe, or a support inbox directly into Salesforce

Push Salesforce opportunity changes into Slack, email, or a data warehouse

Deduplicate or enrich contact records before they hit your CRM

Trigger downstream billing or provisioning workflows when a deal closes

Build custom reporting pipelines without touching Salesforce’s native reporting limits

Because n8n is self-hosted, you’re not billed per execution the way you are with SaaS automation tools — you’re only paying for the VPS it runs on.

Prerequisites

Before you start, you’ll need:

A Linux server (Ubuntu 22.04+ recommended) with Docker and Docker Compose installed

A Salesforce account with API access enabled (Enterprise, Unlimited, or Developer Edition all support this)

A registered Salesforce Connected App for OAuth2 credentials

A domain or subdomain pointed at your server if you want a stable OAuth callback URL

If you haven’t set up a Docker host yet, our Docker networking guide covers the basics of exposing containers safely, which matters once n8n needs to receive Salesforce webhooks.

Setting Up n8n with Docker

The fastest reliable path to a production-ready n8n instance is Docker Compose. Avoid the npx n8n quick-start for anything beyond a five-minute test — it doesn’t persist workflow data properly.

Create a project directory and a docker-compose.yml:

version: "3.8"

services:
  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    restart: unless-stopped
    ports:
      - "5678:5678"
    environment:
      - N8N_HOST=n8n.yourdomain.com
      - N8N_PROTOCOL=https
      - N8N_PORT=5678
      - WEBHOOK_URL=https://n8n.yourdomain.com/
      - GENERIC_TIMEZONE=America/New_York
      - N8N_ENCRYPTION_KEY=change-this-to-a-random-32-char-string
    volumes:
      - n8n_data:/home/node/.n8n

volumes:
  n8n_data:

Bring it up:

docker compose up -d
docker compose logs -f n8n

Once the container is healthy, put a reverse proxy in front of it for TLS. If you haven’t set that up, our Traefik reverse proxy walkthrough shows the exact labels needed for automatic Let’s Encrypt certificates.

Registering a Salesforce Connected App

Salesforce requires OAuth2 for third-party API access. To generate credentials:

1. In Salesforce, go to Setup → App Manager → New Connected App
2. Enable OAuth Settings and set the callback URL to https://n8n.yourdomain.com/rest/oauth2-credential/callback
3. Add these OAuth scopes: Access and manage your data (api), Perform requests at any time (refresh_token, offline_access)
4. Save, then wait 2-10 minutes for Salesforce to propagate the app (this delay trips up a lot of first-time setups)
5. Copy the generated Consumer Key and Consumer Secret

Full field-level detail on Connected App scopes is in Salesforce’s own documentation, which is worth skimming if your org has stricter security policies.

Configuring Salesforce Credentials in n8n

Inside the n8n editor:

1. Go to Credentials → New → Salesforce OAuth2 API
2. Paste in the Consumer Key and Consumer Secret from the Connected App
3. Set the Environment field to production or sandbox depending on your org
4. Click Connect my account — this opens Salesforce’s login/consent screen
5. After granting access, n8n stores an encrypted refresh token so future workflow runs don’t require re-authentication

If the OAuth callback fails silently, it’s almost always one of two things: the callback URL doesn’t exactly match what’s registered in the Connected App, or your reverse proxy is stripping the https scheme header. Check X-Forwarded-Proto is being passed correctly.

Building Your First n8n Salesforce Workflow

A common starting workflow: capture a form submission via webhook, then create or update a Salesforce Lead.

Step 1 — Webhook Trigger node

Add a Webhook node set to POST, path new-lead. This gives you a URL like https://n8n.yourdomain.com/webhook/new-lead that any external form or service can hit.

Step 2 — Salesforce node

Add a Salesforce node, select the credential you created, set:

Resource: Lead

Operation: Upsert

External ID Field: Email

Map incoming JSON fields (firstName, lastName, company, email) to Salesforce Lead fields

Using Upsert with an external ID field (usually email) prevents duplicate lead creation if the same contact submits twice.

Step 3 — Notification node

Add a Slack or Send Email node after the Salesforce node to alert your sales team when a new lead lands.

Here’s the equivalent workflow expressed as an n8n JSON export, useful if you want to import it directly:

{
  "name": "New Lead to Salesforce",
  "nodes": [
    {
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "new-lead",
        "httpMethod": "POST"
      }
    },
    {
      "name": "Salesforce",
      "type": "n8n-nodes-base.salesforce",
      "parameters": {
        "resource": "lead",
        "operation": "upsert",
        "externalId": "Email"
      }
    }
  ]
}

Testing the Webhook End to End

Use curl to simulate a form submission and confirm the Lead is created:

curl -X POST https://n8n.yourdomain.com/webhook/new-lead 
  -H "Content-Type: application/json" 
  -d '{
    "firstName": "Jane",
    "lastName": "Doe",
    "company": "Acme Corp",
    "email": "[email protected]"
  }'

Check the n8n execution log for a green checkmark, then confirm the record appears in Salesforce under Leads.

Other Practical Use Cases

Beyond lead capture, teams commonly build:

Opportunity-to-Slack alerts — trigger a Slack message whenever an Opportunity stage changes to “Closed Won”

Support ticket sync — mirror Zendesk or Freshdesk tickets as Salesforce Cases

Data enrichment — call Clearbit or a similar enrichment API before writing Contact records

Scheduled reporting — pull a SOQL query nightly and push results into Google Sheets or a Postgres warehouse

Two-way sync — keep a marketing tool’s contact list aligned with Salesforce Contacts using n8n’s Schedule Trigger node

SOQL queries can be run directly from the Salesforce node using the Get Many operation with a custom query:

SELECT Id, Name, StageName, Amount
FROM Opportunity
WHERE StageName = 'Closed Won'
AND CloseDate = THIS_MONTH

Troubleshooting Common Errors

INVALID_SESSION_ID — the OAuth token expired or was revoked; reconnect the credential in n8n

REQUIRED_FIELD_MISSING — Salesforce validation rules or required fields aren’t mapped; check your org’s Lead/Opportunity page layout for mandatory fields

DUPLICATE_VALUE — you’re inserting instead of upserting; switch the operation and set an external ID field

Webhook never fires — confirm your reverse proxy isn’t blocking POST requests or stripping the request body; test with curl -v to see raw response codes

Rate limit errors (REQUEST_LIMIT_EXCEEDED) — Salesforce API limits are per-24-hour rolling window; batch operations using n8n’s Split In Batches node instead of firing one API call per record

Hosting Considerations

Since n8n runs continuously and holds OAuth tokens for a system as sensitive as your CRM, host it on infrastructure you control rather than a shared or free-tier box. A 2 vCPU / 4GB droplet is plenty for moderate workflow volume. DigitalOcean droplets are a straightforward option if you want managed backups and a simple firewall setup without managing bare metal. If you’re optimizing for cost at higher resource tiers, Hetzner cloud instances typically offer more RAM and CPU per dollar, which matters if you’re running n8n alongside a database and reverse proxy on the same box.

Whichever provider you choose, put n8n behind a firewall that only allows inbound traffic on 443 and your SSH port, and rotate the N8N_ENCRYPTION_KEY only if you’re prepared to re-authenticate every stored credential — rotating it invalidates existing encrypted credentials.

For a deeper comparison of self-hosting automation tools versus SaaS alternatives, see our breakdown of self-hosting n8n vs. Zapier.

Security Best Practices

Restrict the Salesforce Connected App’s IP ranges if your n8n server has a static IP

Use a dedicated Salesforce integration user with the minimum permission set needed, not an admin account

Enable n8n’s built-in basic auth or SSO if the editor UI is exposed publicly

Back up the n8n_data volume regularly — it contains encrypted credentials and workflow history

Review Salesforce’s API usage dashboard periodically to catch runaway workflows before they hit rate limits

Recommended: Ready to put this into practice? DigitalOcean is a tool we use for exactly this, and we have a real, disclosed affiliate relationship with them.

FAQ

Does n8n have a native Salesforce node, or do I need a custom HTTP request?
n8n ships a native Salesforce node supporting Leads, Contacts, Opportunities, Accounts, Cases, and custom objects. For objects or endpoints it doesn’t cover directly, you can fall back to the HTTP Request node against the Salesforce REST API using the same OAuth2 credential.

Can I use n8n with Salesforce sandbox environments?
Yes. When configuring the Salesforce OAuth2 credential, set the Environment field to sandbox instead of production. This points n8n at test.salesforce.com for authentication instead of the live login endpoint.

Is n8n free to use with Salesforce?
The self-hosted, source-available version of n8n is free to run under its Sustainable Use License. You only pay for the server it runs on. n8n Cloud is a separate paid hosted option if you’d rather not manage infrastructure.

What Salesforce API limits should I worry about?
Salesforce enforces daily API call limits based on your edition and license count. Bulk operations count against the same limit as single-record calls, so batch updates using SOQL queries and bulk upsert operations instead of looping single-record calls in n8n.

How do I handle Salesforce field-level security in n8n workflows?
The integration user’s profile and permission sets determine what fields n8n can read or write — Salesforce enforces this at the API level regardless of what n8n sends. If a field update silently fails, check the integration user’s field-level security settings first.

Can n8n trigger workflows based on Salesforce changes in real time?
Yes, using Salesforce Platform Events or Change Data Capture combined with n8n’s Webhook node, or by polling with a Schedule Trigger node running a SOQL query on a short interval if real-time push isn’t configured.

Wrapping Up

Connecting n8n and Salesforce gives you CRM automation without recurring per-task billing or the platform limits of Salesforce Flow. Start with a single workflow — lead capture or opportunity alerts are the easiest wins — then expand into two-way sync once you’re comfortable with the Salesforce node’s field mapping and error handling. The setup cost is mostly in the OAuth Connected App configuration; once that’s done, adding new workflows takes minutes.

If you’re planning to run several automation workflows alongside other self-hosted tools, check our guide on choosing the right VPS for Docker workloads to make sure your server has enough headroom as workflow volume grows.