Heroku AppLink

Last updated July 14, 2025

Heroku AppLink (formerly Heroku Integration) is an add-on that exposes Heroku apps as API services in Salesforce. Heroku developers can build APIs on Heroku that Salesforce admins and developers can use to execute actions in Salesforce Flow, Apex, Data Cloud, and Agentforce. The add-on supports multiple user interaction modes, and enforces Salesforce user permissions and rules when interacting with your data and using Heroku SDKs.

Heroku AppLink provides:

  • Integration between Heroku, Salesforce, Data Cloud, and Agentforce: Connect and publish your Heroku apps to interact with Salesforce, Data Cloud, and Agentforce in an easy and secure way.
  • Action creation: Generate external service actions and Agentforce agent actions automatically from your app’s APIs and invoke them in Salesforce.
  • Flows and Apex-based invocation: Use Salesforce Flow and Apex to call your published Heroku apps synchronously or asynchronously.
  • Managed security: Choose between three user interaction modes for your apps to set the permissions of the user within Salesforce when executing operations with Salesforce data.
  • SDK APIs: Use our SDK APIs in your Heroku apps to perform Data Manipulation Language (DML) operations on Applink-enabled Salesforce and Data Cloud orgs.

If you’re new to Heroku, sign up for an account, and see these resources to learn more about Heroku:

Use Cases

Here’s a few examples of what you can do with Heroku AppLink:

  • Generate PDFs: Deploy a Puppeteer-based microservice on Heroku that generates PDFs from Salesforce. You can also maintain user context when querying Salesforce data.
  • Perform bulk jobs: Perform data transformations by passing Salesforce data to Heroku’s compute services, such as adding complex calculations or making API calls to get more data. The results are persisted back to Salesforce or to Data Lake Objects (DLOs) in Data Cloud.
  • Deploy custom Agentforce actions: Develop a custom action on Heroku written in the language of your choice for your Agentforce agent. Use custom actions to interpret natural language requests from users and perform dynamic calculations on the data.
  • Expose custom MCP servers: Build and deploy a custom MCP server in Heroku and expose the MCP server in Salesforce.

You can only use Heroku AppLink with Salesforce editions that have API access. Some Salesforce editions don’t have API access by default and aren’t compatible with Heroku AppLink.

Heroku AppLink is a separate add-on from the pilot Heroku Integration add-on. If you participated in the pilot, you must provision the Heroku AppLink add-on and republish your Heroku app.

Heroku AppLink consists of several components, such as the CLI plugin, the API, and service mesh. There are different ways to start using Heroku AppLink, such as through the SDKs, reference apps, and getting started guides.

The Heroku AppLink CLI plugin allows you to set up and manage the Heroku AppLink add-on through the command line interface. Before connecting your Heroku apps to your Salesforce orgs, you must install the plugin. See Heroku AppLink CLI Plugin for more information.

The Heroku AppLink API allows you to set up and manage relationships between Salesforce and Data Cloud orgs and AppLink-enabled apps. See Heroku AppLink API for more information.

The Heroku Buildpack for Heroku AppLink Service Mesh installs the Heroku AppLink Service Mesh to handle the authentication and authorization for your app. The service mesh is a proxy in front of your app that intercepts incoming requests for validation and capabilities. The buildpack:

  • Starts your app.
  • Verifies inbound requests to your app only from known clients. Only published apps from connected orgs can invoke the app.
  • Provides scoped tokens for your app. Authorization tokens ensure that DMLs performed using the SDK adhere to the permissions defined in Salesforce. Admins and developers can add defined permission sets to determine what data the app has access to.

Use the Salesforce SDKs to develop Heroku AppLink managed apps that interact with Salesforce and Data Cloud orgs. The Heroku AppLink reference apps speed up development by generating sample code that uses our SDKs to call your APIs.

SDK Reference App
Node.js AppLink SDK for Salesforce Heroku AppLink Node.js Reference App
Python AppLink SDK for Salesforce Heroku AppLink Python Reference App

Getting Started Guides

See our getting started guides to learn how to use Heroku AppLink with different use cases.

Provisioning the Add-on

You can provision an AppLink add-on on one app and share it across multiple apps. For more information about how to provision Heroku AppLink, see Working with Heroku AppLink.

User Permissions

There are required user permissions you must assign in Heroku or in Salesforce to perform operations with Heroku AppLink. See Working with Heroku AppLink for the required permissions.

Connections on Your App

You can’t use connections in your app’s code to query data. Instead, you must create an authorization.

When you create a connection, Heroku AppLink establishes a trusted connection between the Salesforce or Data Cloud org and AppLink add-on instance. Connecting to Salesforce lets you publish your apps as external services and generate API actions in Salesforce. Connecting to a Data Cloud org creates a Data Cloud access token to make calls to the Data Cloud API.

You must create a connection for every org that interacts with your AppLink-enabled app. You can connect your app to Salesforce and Data Cloud orgs in production, sandbox, and scratch org environments. You can also connect multiple orgs to one app. As a best practice, we recommend not mixing environment types. For example, connect your sandbox orgs to staging apps and connect your production orgs to production apps. If you attach your AppLink add-on to multiple apps, you can share connections across your apps.

For more information about how to create, view, and remove connections, see Working with Heroku AppLink.

Authorizations on Your App

You can’t use authorizations to publish apps to Salesforce. Instead, you must create a connection.

When you create an authorization, Heroku AppLink stores the security token of the user you log in as when connecting to a Salesforce or Data Cloud org. Use authorizations in your app’s code to invoke Salesforce APIs and perform DML operations in Salesforce and Data Cloud as the specific authorized user, such as an API user.

You can authorize users in production, sandbox, and scratch org environments. You can also authorize users in multiple orgs to one app. If you attach your AppLink add-on to multiple apps, you can share authorizations across your apps.

For more information about how to create, view, use, and remove authorizations, see Working with Heroku AppLink.

Publish Your App

When you publish your Heroku app to Salesforce, AppLink creates an external service, adds your app’s APIs to API Catalog, and generates agent actions in Agentforce. You can then use these actions to invoke the app with Salesforce Flow, Apex, Data Cloud, and Agentforce. Only connected Salesforce and Data Cloud orgs can invoke your published apps.

For more information about how to publish your apps, see Working with Heroku AppLink.

Configuring OpenAPI Specification

You can configure the OpenAPI spec file to enable specific actions, such as Agentforce actions, and define permission sets for your invoking user. Heroku supports OpenAPI 3.0. See Configuring OpenAPI Specification for Heroku AppLink for more information.

Invoke Your Published Apps

After publishing your app, you can invoke your app’s actions in Salesforce with:

For more information about how to invoke your app, see Invoking Your Heroku AppLink Apps.

Heroku AppLink has its own dashboard to view connections, authorizations, and app publications. See Heroku AppLink Dashboard for more information.

Logging

You can view AppLink logs with Heroku’s standard tail logs with the heroku logs command. See Heroku AppLink Logging and Common Errors for more information and common AppLink errors.

Security

While Heroku AppLink is supported in all Common Runtime and Private Space regions, the AppLink service currently runs in the virginia region. CLI and app invocation latency is based on the app’s region distance from virginia.

Heroku AppLink authenticates and authorizes requests between your application and Salesforce with a service mesh. The service mesh is a proxy in front of your app that intercepts incoming requests for validation and capabilities.

User Modes

There are three user mode options that apply the permissions and roles defined in your Salesforce org when using our SDK: user, user-plus, and authorized-user. You can manage what Salesforce data your Heroku apps can access depending on the user mode. See Heroku AppLink User Mode Options for more information.

Considerations and Limitations

See Heroku AppLink Limits for a list of limits and details.

Support

Submit all Heroku AppLink support and runtime issues via one of the Heroku Support channels.

Additional Reading

Feedback

Log in to submit feedback.