Salesforce Admin Guide

Last updated: August 5, 2026 · Contact: [email protected]

This page is for Salesforce administrators. A sales rep at your company uses Prospect 811 and wants to push their prospect list into your Salesforce org as Leads. If they tried to connect before you finished this setup, they saw this error:

invalid_client: app must be installed into org

That is Salesforce saying our app package is not installed in your org yet. Installing it takes about five minutes and two steps. No Apex, no triggers, no code runs in your org: the package contains four custom fields on Lead, one permission set, and the OAuth connected app definition. Nothing else.

Quick setup (about 5 minutes)

Install the package. Log in to Salesforce as an admin, then open this install URL:
https://login.salesforce.com/packaging/installPackage.apexp?p0=04thk000001UV93AAG
Choose Install for Admins Only (recommended: rep access is granted by the permission set in the next step, not by the install-time choice) and click Install.
Installing into a sandbox first? Use the same URL with test.salesforce.com in place of login.salesforce.com.
Assign the permission set. Setup → Permission Sets → Prospect 811 Rep → Manage Assignments → add each rep who uses Prospect 811. This grants field-level access to the four packaged fields below and nothing more.
Done. Have the rep click Connect Salesforce in Prospect 811 and approve the OAuth prompt with their own Salesforce login.

What the package contains

Package name Prospect 811, namespace p811, managed (upgrades are automatic when you install a newer version; the fields and their data are never removed by an upgrade).

Component	API name	Details
Lead field: NPI	`p811__NPI__c`	Text(10), External ID, Unique (case-insensitive). The National Provider Identifier. This is the upsert key: it is what makes repeat pushes update existing Leads instead of creating duplicates.
Lead field: P811 Status	`p811__P811_Status__c`	Text(50). The rep's Prospect 811 pipeline status, mirrored as-is.
Lead field: P811 Qualified	`p811__P811_Qualified__c`	Checkbox. Whether the rep marked the provider qualified.
Lead field: P811 Specialty	`p811__P811_Specialty__c`	Text(120). Provider specialty from the NPI registry.
Permission set	`p811__Prospect_811_Rep`	Field-level read/edit on the four fields above. No object permissions, no system permissions.
Connected app	Prospect 811	The OAuth app your reps authorize. Scopes: `api`, `refresh_token`. PKCE and refresh-token rotation are enforced.

How the integration behaves

Each rep authorizes individually with their own Salesforce login. Everything the integration writes is done as that rep, under your org's own sharing rules, validation rules, and permissions.
Data flows one way by default: into your org. A push creates or updates Leads (name, practice, address, phone, specialty, and the fields above), keyed on NPI so repeat pushes update rather than duplicate. Pushes also write the rep's mapped value into the standard Lead Status field, using your org's own Lead Status values.
Duplicate rules: pushes ask Salesforce to save through alert-level duplicate rules. Block-level rules still block, and the rep sees the error per record.
Revoke anytime: Setup → Connected Apps OAuth Usage shows the app and its users; you can block the app or revoke individual tokens there, which cuts off the integration's access to your org. Prospect 811 stores its copy of the tokens encrypted and deletes them on request: email [email protected].

If Connect still fails after installing

What the rep sees	Likely cause and fix
`invalid_client: app must be installed into org`	The package is not installed yet (or was installed in a sandbox, not production). Run Quick setup step 1 in the org the rep logs into.
OAuth error mentioning approval, or the rep cannot get past the login	Your org sets the app's Permitted Users to “Admin approved users are pre-authorized.” Open the app in Setup (Connected Apps → Manage), and under Permitted Users add the Prospect 811 Rep permission set (or the reps' profiles) to the app's approved list.
Generic OAuth error that persists for some reps only	IP restrictions. Prospect 811's servers call the Salesforce API from cloud IP addresses. In the app's policies in Setup, set IP Relaxation to Relax IP restrictions. Login-hours and login-IP restrictions on the rep's profile can also surface as `invalid_grant`.
`API_DISABLED_FOR_ORG` or “this org has no API access”	Your Salesforce edition does not include REST API access (Professional needs the Web Services API add-on; Starter and some legacy editions have none). Reps can still export CSV files from Prospect 811 and import them with the Data Import Wizard.
Rep connected fine but pushed fields are empty	The rep is missing the Prospect 811 Rep permission set (fields without field-level access are silently dropped on write). Run Quick setup step 2.
Rep is asked to reconnect after a month away	Expected. Refresh tokens idle-expire after 30 days without use. Reconnecting takes one click and one OAuth approval.

Security notes

OAuth 2.0 web server flow with PKCE; refresh-token rotation and a 30-day idle refresh-token timeout are enforced on our app registration.
Tokens are stored encrypted on Prospect 811's servers, and we delete them on request (email [email protected]). Revoking the app from Salesforce Setup cuts off its access either way. We never see or store your reps' Salesforce passwords.
The integration reads only what it needs to operate (Lead describe, Lead Status values, and the Leads it writes, to confirm the write landed). It does not sync, export, or crawl your CRM data.
Our Privacy Policy describes the Salesforce data flows in full.

Questions, or an org shape this page does not cover (existing NPI field, package-restricted org, SSO edge cases)? Email [email protected] and we will sort it out with you.