Skip to main content
The Email Cases path wires OpenCX into Salesforce Case Management. Use it for email — the channel where every handoff should become a trackable . Chat, SMS, WhatsApp, and phone belong on Live Messaging instead.
Setup takes about 30 minutes. You need a Salesforce System Administrator profile and admin access in OpenCX.

Before you start

Enterprise, Unlimited, or Developer edition. Professional edition requires API access to be enabled separately.
You need to create an External Client App, a Named Credential, an Apex Class, and an Apex Trigger. Standard user roles cannot reach these.
Required to save integration settings in Settings → Integrations.

Setup

1

Create an External Client App in Salesforce

Salesforce Starter edition does not support External Client Apps or Connected Apps. OAuth/API integrations require Enterprise, Unlimited, Developer, or Performance edition.
In Salesforce, go to Setup → Platform Tools → Apps → App Manager and click New External Client App.
  1. Fill in the basic information (App Name, API Name, Contact Email).
  2. Under API (Enable OAuth Settings), check Enable OAuth Settings.
  3. Set the Callback URL to:
  4. Select scopes: Full access (full) and Perform requests at any time (refresh_token, offline_access).
  5. Check Require Secret for Web Server Flow.
  6. Check Require Secret for Refresh Token Flow.
  7. Click Save.
Copy the Consumer Key and Consumer Secret:
  1. Open the saved app and switch to the Settings tab.
  2. Scroll to App Settings → OAuth Settings and click the Consumer Key and Secret button.
  3. Salesforce will ask you to verify your identity — typically an email verification code or other MFA challenge.
  4. After you verify, Salesforce opens a page displaying the Consumer Key and Consumer Secret. Copy both.
It may take 2–10 minutes for a new External Client App to activate. If the next step fails immediately, wait and retry.
2

Enter credentials and connect

In your OpenCX dashboard, open Salesforce and select the Email tab.Click Save Credentials, then click Connect to Salesforce. A Salesforce login window opens. Sign in, then on the authorization screen click Allow to grant OpenCX access. When you return to OpenCX, the status shows Connected.
The Webhook URL appears only after the connection succeeds — it does not show up the moment you open the Email tab. Complete the Connect to Salesforce → Allow flow first, then the URL is revealed in the same place for you to copy in the next step.
3

Set up Email-to-Case routing and mail forwarding

OpenCX sends outbound emails from inside Salesforce (via the Apex trigger further down). For contacts to reach Salesforce in the first place — and for their replies to flow back onto the same Case — you need an Email-to-Case routing address configured and your customer-facing mailbox forwarding into it.1. Enable Email-to-Case. Go to Setup → Quick Find → “Email-to-Case” → Email-to-Case Settings and confirm:
  • Enable Email-to-Case — checked.
  • Enable on-demand service — checked (this is what makes the Salesforce-generated inbound address work without running a local agent).
  • Insert email threading token in email subject — checked.
  • Insert email threading token in email body — checked.
  • Use email headers for threading — checked.
Once Email-to-Case is enabled, it can’t be disabled, but its settings can be edited. If the feature is already enabled, just verify the checkboxes above.2. Create a Routing Address. On the same Email-to-Case Settings page, scroll to Routing Addresses and click New. Fill the form exactly as follows for a production-ready setup:Routing InformationEmail SettingsTask SettingsCase SettingsFlow SettingsSave. Salesforce then emails a verification link to the Email Address you entered — open that inbox and click the link. The address must show Verified before anything will work.Salesforce also auto-generates a long Email Services Address at the bottom of the routing record — something like:
Copy this long address. You’ll forward into it in the next step. To retrieve it later: Setup → Email-to-Case → Routing Addresses → [row] → Email Services Address.3. Forward your customer-facing mailbox to the Salesforce inbound address. Email clients don’t let you set Salesforce as an MX target directly (unless you control the DNS zone for the customer-facing domain). The reliable path is standard forwarding at the mailbox level. Example for Gmail:
  1. In Gmail for [email protected], open Settings → Forwarding and POP/IMAP → Add a forwarding address.
  2. Paste the long ...case.salesforce.com address.
  3. Gmail sends a verification email to that address. Because the destination is Salesforce, the verification email lands as a new Case in your org. In Developer Console → Query Editor:
    Open the newest row and copy the 9-digit code from TextBody.
  4. Paste the code back into Gmail’s forwarding screen → Verify. The address should now be Confirmed and forwarding is live.
Other providers (Outlook, FastMail, custom domains on cPanel, etc.) follow the same shape — forward → verify via the code Salesforce captured. If forwarding stays stuck at “Unverified”, no Cases will be created; don’t proceed until it’s Verified.
Plain mailbox forwarding can fail anti-spam / DMARC checks on the way into Salesforce. If test emails never turn into Cases after the forward is verified, publish include:_spf.salesforce.com in your SPF record, or use SRS-aware forwarding.
4

Configure the webhook in Salesforce

After connecting, OpenCX displays a Webhook URL. Copy it.
The webhook URL includes a secure token. Treat it like a password — do not share it publicly.
Create a Named Credential in Salesforce:
  1. Go to Setup → Security → Named Credentials. On the Named Credentials page, click the dropdown arrow next to New and choose New Legacy.
  2. Set Label to OpenCX_Integration — this is an example, pick any name you like. The Name field auto-populates from the label.
  3. Paste the webhook URL into the URL field.
  4. Under Authentication, set Identity Type to Anonymous and Authentication Protocol to No Authentication.
  5. Under Callout Options, check Generate Authorization Header and Allow Merge Fields in HTTP Body.
  6. Save.
Create the Apex Class:
Every class and trigger name in the rest of this step is an example — you may keep the suggested names or pick your own. Names don’t affect behavior, but if you rename the Apex class, update every trigger’s reference to match.
Go to Setup → Apex Classes and click New. Alternatively, open the Developer Console (top-right gear icon → Developer Console), then go to File → New → Apex Class. Either path works.Paste the following (the class name OpenSalesforceCaseManagement is an example — rename freely, but remember to update the triggers below to match):
Save the class: click Save at the bottom of the Salesforce UI, or in the Developer Console use File → Save (⌘S on Mac, Ctrl+S on Windows/Linux).Create the Apex Triggers:OpenCX needs five triggers in total: three core triggers for new cases, customer email replies, and human-agent emails sent from the Case; one optional trigger for owner reassignment; and one required trigger that actually transmits outbound AI replies to the contact.All five triggers are authored the same way. To open the trigger editor:
  1. In Salesforce, open the Developer Console (top-right gear icon → Developer Console).
  2. From the Developer Console’s top-left menu, go to File → New → Apex Trigger.
  3. Fill in the Name (examples below — rename to whatever you prefer) and the sObject, then click Submit.
  4. Paste the snippet into the editor.
  5. Save with File → Save (or ⌘S on Mac, Ctrl+S on Windows/Linux).
1. Case trigger (new cases) — Name: OpenCaseTrigger (example, renameable). sObject: Case.
2. EmailMessage trigger (customer replies) — Name: OpenEmailMessageCustomerTrigger (example, renameable). sObject: EmailMessage.
Without this trigger, OpenCX won’t see customer replies and the AI can’t follow up. Outbound emails (ones OpenCX sends via API) have Incoming=false and are skipped, so no self-loop.3. EmailMessage trigger (human agent sends email from Salesforce) — optional but recommended. Name: OpenEmailMessageHumanAgentTrigger (example, renameable). sObject: EmailMessage.
Set INTEGRATION_USERNAME (first line of the trigger) to the exact Username of the user OpenCX authenticated as during OAuth. In after insert, UserInfo.getUserId() always equals CreatedById, so comparing the two would never discriminate between OpenCX and a human agent. We must compare against the integration user’s actual Id, resolved via their Username.
Use this if your agents sometimes reply directly in Salesforce via the Case’s Send Email action — OpenCX will mark the session as handed off and log the agent’s reply in the chat history.4. Case trigger (owner change) — optional but recommended. When a rep manually reassigns the Case (taking ownership away from the OpenCX integration user), the AI should stop replying. Name: OpenCaseOwnerChangeTrigger (example, renameable). sObject: Case.
When this fires, OpenCX marks the session as handed-off and pauses autonomous AI replies. OpenCX’s own ownership changes (during takeover / handoff) skip via the != UserInfo.getUserId() guard.5. EmailMessage trigger (outbound email delivery)required. This is the trigger that actually transmits OpenCX’s AI replies to the contact, injects Salesforce’s threading token so customer replies attach to the same Case, and redirects replies back to your Email-to-Case routing address. Name: OpenCxOutboundEmailSender (example, renameable). sObject: EmailMessage.
Before saving, set both constants at the top of the trigger:
  • INTEGRATION_USERNAME — the exact Username of the user OpenCX OAuth’d as. Find it in Setup → Users → Users (the Username column, looks like an email). This must match exactly or the trigger silently skips every outbound EmailMessage.
  • REPLY_TO_ADDRESS — your customer-facing forwarding address, e.g. [email protected]. Must be registered as a Verified Routing Address in Setup → Email-to-Case → Routing Addresses.
Without this trigger, OpenCX’s AI replies are logged to the Case Feed as EmailMessage records but never actually delivered to the contact — a plain EmailMessage insert is a data row, not an SMTP send. The reply will show as “sent” in the OpenCX dashboard and appear in the Salesforce Case Feed, but the contact’s inbox will stay empty.
What each block does:
  • em.ParentId.getSObjectType() == Case.SObjectType — matches EmailMessage rows whose parent is a Case, without hard-coding the 500 Id prefix.
  • em.CreatedById != integrationUserId / == — the reason we look up the integration user by Username instead of UserInfo.getUserId(). In after insert, UserInfo.getUserId() always equals CreatedById, so a naive equality check would always be true and the trigger would fire for every outbound EmailMessage — including human-agent sends, causing double-delivery.
  • ContentDocumentLink / ContentVersion query — forwards any files OpenCX attached to the outbound EmailMessage (modern Salesforce Files). If OpenCX never attaches files in your configuration, this runs once per trigger with zero rows and is effectively free.
  • CcAddress / BccAddress splitting — preserves cc / bcc recipients if OpenCX ever populates them. Split tolerates commas, semicolons, trailing whitespace, and empty segments.
  • EmailMessages.getFormattedThreadingToken(em.ParentId) — generates Salesforce’s Lightning-Threading token. Embedded in a hidden HTML <div> so it never renders visibly, but still survives quoted replies from HTML-capable email clients. Text-only clients fall back to “Use email headers for threading”.
  • mail.setReplyTo(REPLY_TO_ADDRESS) — routes customer replies back to your forwarding/routing address so Salesforce can ingest them. Without this, replies land in the integration user’s personal Salesforce inbox and never reach Email-to-Case.
  • mail.setSaveAsActivity(false) — OpenCX already wrote the EmailMessage record that triggered this send; we don’t want Salesforce to create a second one.
  • The SendEmailResult loop — logs OpenCxOutboundEmailSender sendEmail failed: to the Debug Log when a send is rejected (daily limit exceeded, deliverability off, malformed recipient, etc.). Surface these in Setup → Debug Logs when diagnosing delivery issues.
Org-Wide Email Address (recommended for production): by default the email is sent from the integration user’s personal Salesforce address. To send from a branded address like [email protected], create an Organization-Wide Email Address in Setup → Email → Organization-Wide Addresses, verify it, then add this one line before emails.add(mail):
5

Confirm email deliverability settings

Before the outbound email trigger can actually transmit, your Salesforce org needs two one-time settings:
  1. Setup → Email → Deliverability → Access level must be All email. The trial / sandbox default of System email only blocks Messaging.sendEmail() with NO_MASS_MAIL_PERMISSION.
  2. The integration user’s profile must have Send Email enabled (standard on System Administrator).
Skip this step at your own risk — the trigger will silently throw on every AI reply and nothing will leave Salesforce.
6

Create the Apex Test Class

Salesforce requires ≥ 75% test coverage on every Apex class and trigger before you can deploy to production. This test class covers all four methods of OpenSalesforceCaseManagement plus all five triggers (new case, customer reply, human-agent reply, owner change, outbound email delivery).Go to Setup → Apex Classes and click New, or open the Developer Console and go to File → New → Apex Class. The class name OpenSalesforceCaseManagementTest below is an example — you can rename it freely. Paste:
Salesforce’s HttpCalloutMock intercepts the @future webhook callouts so these tests don’t need a live Named Credential or network access. Test.startTest() / Test.stopTest() flushes the queued @future methods synchronously.
Keep INTEGRATION_USERNAME in sync across all three filesOpenCxOutboundEmailSender, OpenCxHumanAgentReplyTrigger, and OpenSalesforceCaseManagementTest. If they drift, the triggers stop firing for real traffic and the test silently skips the main assertion path (the if (integrationUsers.isEmpty()) return guard), which can mask the breakage behind a green test run.
Save with Save at the bottom, or in the Developer Console use File → Save (⌘S on Mac, Ctrl+S on Windows/Linux).After saving, run the tests: Setup → Apex Test Execution → Select Tests → OpenSalesforceCaseManagementTest. All tests should pass, and coverage on OpenSalesforceCaseManagement + the five triggers will report ≥ 75%.
7

Production readiness checklist

The five triggers + test class are enough to make the integration function. For a production deployment that won’t surprise you in week two, also complete the following:1. Dedicated integration user. Don’t OAuth as a named human. In Setup → Users → Users, clone the System Administrator profile and create a user named OpenCX Integration. OAuth as that user. When real humans leave the company and their logins are disabled, the integration keeps working.2. Organization-Wide Email Address. In Setup → Email → Organization-Wide Addresses, add [email protected] and verify it (Salesforce emails a verification link — click it from the target inbox). Then add one line to OpenCxOutboundEmailSender before emails.add(mail):
Without this, outbound AI replies go out from the integration user’s personal Salesforce address. Customers see a weird-looking From: and spam filters flag it because the sender domain doesn’t match your brand.3. SPF on your sending domain. Publish an SPF record on yourcompany.com that includes Salesforce:
Without it, your outbound AI replies land in spam, and inbound forwarded mail to Salesforce can be rejected at the DMARC layer.4. DKIM signing. In Setup → Email → DKIM Keys → Create New Key, generate a key for your sending domain and publish the two CNAME records Salesforce gives you. Unsigned outbound mail gets aggressively spam-filtered by Gmail and Workspace.5. Case Assignment Rules. In Setup → Case → Case Assignment Rules, define rules that route incoming Cases to the right Queue based on sender domain, routing address, or keywords. This is what makes the “Case Owner = Queue” choice on the Routing Address actually pay off — Queues without rules are just static inboxes.6. Email Deliverability. Setup → Email → Deliverability → Access level must be All email (not System email only). Sandbox / trial defaults block all outbound — your Dev Edition tests will fail here first.7. Daily email limits. Messaging.sendEmail to external addresses is capped per org per GMT-day:If production volume exceeds 5,000/day outbound, replace Messaging.sendEmail with an HTTP callout to an external ESP (SendGrid, Postmark, Mailgun) via a Named Credential — the trigger structure stays the same, only the sending primitive changes. Most support workloads stay well under the cap and don’t need this.8. Monitoring. Turn on Setup → Debug Logs for the integration user before any production cutover. The OpenCxOutboundEmailSender sendEmail failed: lines captured here are your first signal when deliverability, limits, or deliverability settings regress.9. Strengthen the test class with a behavioural assertion. The supplied test class covers the trigger code paths (enough for Salesforce’s ≥ 75% coverage requirement) but the outboundEmailSender_queuesEmail and humanAgentReplyTrigger_firesOnOutgoingEmail tests gate their assertions on the integration user existing in the test org. In a fresh sandbox that’s fine; in a regression-sensitive production deploy, add a @testSetup that creates a dummy user matching INTEGRATION_USERNAME so the full send path is always exercised. Without this, refactors to the trigger body could regress silently while the test stays green.10. Known gaps to track. These are intentionally out of scope for the baseline trigger but worth queueing as follow-up work:
  • Bounce handling. Salesforce sets EmailMessage.IsBounced = true when the outbound message bounces. OpenCX isn’t notified today — a future 6th trigger on EmailMessage (after update) should fire a case_email_bounced webhook so the dashboard flags the failed delivery.
  • Idempotency. If Salesforce re-fires the trigger for the same EmailMessage (bulk load, recovery), the customer receives duplicate copies. Add a custom boolean OpenCx_Sent__c on EmailMessage and set it in the trigger after sendEmail succeeds; short-circuit on the flag at the top of the loop.
  • Rate limiting. Messaging.sendEmail caps at 5,000/day in Enterprise. At higher volumes, swap the send primitive for an HTTP callout to an external ESP (SendGrid / Postmark / Mailgun) via a Named Credential — the trigger’s filter/build logic stays the same.
8

Verify end to end

Send a test email to an address connected to OpenCX. Escalate the conversation (or ask to speak with a human). Within a few seconds:
  1. A Case appears in Salesforce with Case_From__c set to opencx.
  2. Reply on the Case from Salesforce.
  3. The reply appears as an agent message on the matching session in your OpenCX Inbox.
If any step fails, jump to Troubleshooting.

How handoff lands in Salesforce

When triggers, OpenCX:
  1. Creates a Salesforce Case with the conversation topic as Subject and the AI summary as Description.
  2. Sets Case_From__c to opencx so your views and reports can filter to AI-escalated cases.
  3. Attaches the full transcript as Case comments.
  4. Stores the Salesforce Case ID on the OpenCX session for tracing.
  5. When your rep replies on the Case, the webhook fires and OpenCX delivers the reply to the contact’s inbox.
  6. When the Case is closed, the OpenCX session resolves.
If the same contact re-engages before the Case is closed, OpenCX appends to the existing Case instead of opening a new one.

Disconnecting

In OpenCX, open the Salesforce integration and click Disconnect. Then in Salesforce, delete the Named Credential (OpenCX_Integration) and the Apex Trigger/Class you created. Cases created while the integration was active remain untouched.

AI Email in Salesforce

Per-channel implementation details for email handoff.

Live Messaging

The path for chat, SMS, WhatsApp, and phone channels.

Troubleshooting

OAuth errors, missing Cases, webhook issues.

Handoff settings

Global handoff rules and office hours.