Skip to main content

Salesforce testing

Last updated: October 2026
note

This integration provides assistance for certain user-specific use cases, but it is not officially supported. Compatibility with all user requirements is not guaranteed.

This document shows how to automate Salesforce tests with Katalon Studio. The sample project covers lead, case, account, and dashboard management, including an iframe example.

Salesforce may ask for an MFA or identity verification code when a test opens a new browser. First, set up token-based login for each test user. Then replace the login steps in your tests with the access-token test case and run the Salesforce actions.

Use caseActions
Lead managementOpen Salesforce → create a lead → change its status and owner → find and delete it → close the browser
Case managementOpen Salesforce → create a case → edit its status → find and delete it by ID → close the browser
Account managementOpen Salesforce → create an account → close the browser
Dashboard managementOpen Salesforce → create a dashboard → add components and reports → create a filter → delete it → close the browser

Before you begin​

  • Install Katalon Studio and have an active Salesforce account for each test user.
  • Get permission to create a Salesforce External Client App, or use an existing Connected App, and permission to make the test users eligible through profiles or permission sets. Since the Spring '26 release, Salesforce no longer allows creating new Connected Apps by default.
  • Find your org's My Domain URL, such as https://yourdomain.my.salesforce.com. For a sandbox, use https://yourdomain--sandboxname.sandbox.my.salesforce.com. Replace the example domain in every request below.
  • Download the Salesforce sample project if you want to adapt its recorded tests. Its existing login steps use a username and password, so replace them as described in Automate Salesforce test cases.

Set up login without MFA prompts​

Salesforce asks for multi-factor authentication (MFA) or an identity verification code whenever someone logs in through the Salesforce login page from a browser it doesn't recognize. Every Katalon Studio test run opens a new browser, so Salesforce asks a test that logs in through the login page for a code on every run.

Token-based login skips the Salesforce login page. Log in once as each test user, including MFA or SSO, to authorize your app and obtain a refresh token. At the start of each test run, exchange that token for an access token and open Salesforce through frontdoor.jsp. This does not turn off MFA or SSO.

TokenHow long it lastsWhen to get another
Authorization codeA few minutes; single useWhen obtaining a refresh token for a test user
Refresh tokenUntil revoked or expired by your org's policyRepeat Get a refresh token for each test user
Access tokenYour Salesforce session timeout; two hours of inactivity by defaultAt the start of every test run

Create a Salesforce app​

If you already have a Connected App, open it from Setup > App Manager and apply the callback URL, scopes, and policies below. Otherwise, create an External Client App:

  1. Go to Setup in Salesforce, enter External Client App Manager in Quick Find, and click New External Client App.

  2. Enter a name and a contact email, and set Distribution State to Local.

  3. Expand API (Enable OAuth Settings) and select Enable OAuth.

  4. Enter your My Domain URL followed by /services/oauth2/success in Callback URL, for example https://yourdomain.my.salesforce.com/services/oauth2/success. Do not use the home page or root URL: Salesforce redirects those pages, and you lose the authorization code.

  5. Add Manage user data via Web browsers (web), Manage user data via APIs (api), and Perform requests at any time (refresh_token, offline_access) to OAuth Scopes.

    Salesforce OAuth settings with placeholder callback URL and selected scopes

  6. Select Require secret for Web Server Flow and Require secret for Refresh Token Flow in Security, and leave Enable Refresh Token Rotation cleared.

    If Salesforce locks Require Proof Key for Code Exchange (PKCE) or Enable Refresh Token Rotation on, leave them. The next stages cover the PKCE step and the Rotating refresh token script.

  7. Click Create.

  8. Click Edit on the Policies tab and expand OAuth Policies.

  9. Select Admin approved users are pre-authorized in Permitted Users, and add the profiles or permission sets of your test users. To only try out the setup, you can select All users can self-authorize instead.

  10. Set Refresh Token Policy to Refresh token is valid until revoked and click Save.

  11. Expand OAuth Settings on the Settings tab and click Consumer Key and Secret.

  12. Copy the Consumer Key and the Consumer Secret. Keep the secret out of source control.

Get a refresh token for each test user​

Run these requests manually, once for each test user. Repeat them if the refresh token expires or is revoked.

  1. PKCE-enabled apps only: Generate a code verifier and challenge by running this script in a Katalon Studio test case. Keep both values for the authorization and token requests below.

    import java.security.MessageDigest
    import java.security.SecureRandom

    byte[] random = new byte[32]
    new SecureRandom().nextBytes(random)
    String verifier = Base64.getUrlEncoder().withoutPadding().encodeToString(random)
    String challenge = Base64.getUrlEncoder().withoutPadding().encodeToString(
            MessageDigest.getInstance('SHA-256').digest(verifier.getBytes('US-ASCII')))
    println "code_verifier = ${verifier}"
    println "code_challenge = ${challenge}"

  2. Open a new or existing project in Katalon Studio.

  3. Create a new web service request of type RESTful and name it Retrieve Authorization code to access bearer token and refresh token. If you change this name, update any references to it.

  4. Set the method to GET, enter https://yourdomain.my.salesforce.com/services/oauth2/authorize as the URL, and add the following query parameters.

    ParameterValue
    response_typecode
    client_idThe Consumer Key of your app.
    redirect_uriThe callback URL of your app, for example https://yourdomain.my.salesforce.com/services/oauth2/success.
    code_challengeOnly if your app requires PKCE. Use the challenge from the PKCE step above.
    code_challenge_methodOnly if your app requires PKCE. Enter S256.

  5. Clear the Follow redirects checkbox. Katalon Studio selects this option by default in projects created with version 9.7.0 or later. If it stays selected, the request returns the Salesforce login page instead of the URL you need.

    Katalon Studio authorization request with placeholder Salesforce domain and consumer key, and Follow redirects cleared

  6. Click Test Request. The response status is 302.

  7. Copy the value of Location on the Header tab.

  8. Paste the copied URL into the address bar of your browser.

  9. Log in as the test user, including MFA or SSO. If Salesforce asks you to allow access, click Allow.

  10. Copy the authorization code from the address bar. The browser stops on a page titled Remote Access Application Authorization, and the address bar shows https://yourdomain.my.salesforce.com/services/oauth2/success?code=.... The authorization code is the value after code=.

  11. Decode the code in your browser. Press F12, open the Console tab, and run decodeURIComponent("paste the code here"). For example, aPrxsdssXvusdaaJ4hOFlX4ZHYQMhdjsi9HOTTTw6mQZ%3D%3D becomes aPrxsdssXvusdaaJ4hOFlX4ZHYQMhdjsi9HOTTTw6mQZ==.

    caution

    The authorization code is a credential, so don't paste it into third-party decoding tools. The code works only once and expires within minutes. Continue with the next step right away.

  12. Create a new web service request and name it Retrieve Bearer Token and Refresh Token for the first time using Authorization code.

  13. Set the method to POST and enter https://yourdomain.my.salesforce.com/services/oauth2/token as the URL.

  14. Select x-www-form-urlencoded on the HTTP Body tab and add the following parameters.

    ParameterValue
    grant_typeauthorization_code
    codeThe decoded authorization code.
    client_idThe Consumer Key of your app.
    client_secretThe Consumer Secret of your app.
    redirect_uriExactly the same value as in the authorization request.
    code_verifierOnly if your app requires PKCE. The verifier from the PKCE step above.
    Katalon Studio authorization code exchange request with placeholder credentials and callback URL

  15. Click Test Request. The response contains access_token, refresh_token, and instance_url.

  16. Store the refresh_token outside the project. For a fixed token, provide it as the SF_REFRESH_TOKEN environment variable to the Katalon Studio process. For rotation, use the file described below. Clear the authorization code and Consumer Secret from the one-time request before saving the project. Tokens give access as the test user; keep them and the Consumer Secret out of source control.

Open Salesforce with an access token​

  1. Create a RESTful request named Retrieve Bearer Token using Refresh Token. Set its method to POST and URL to https://yourdomain.my.salesforce.com/services/oauth2/token.

  2. In HTTP Body tab, select x-www-form-urlencoded and add:

    ParameterValue
    grant_typerefresh_token
    client_id${clientId}
    client_secret${clientSecret}
    refresh_token${refreshToken}
    Katalon Studio refresh token request with variable placeholders

  3. On Variables, add clientId, clientSecret, and refreshToken with empty default values. The test case supplies them at runtime. If you use Test Request manually, supply values only for that test and clear them before saving the request. A refresh token saved as a default is stored in the project.

  4. Create a test case named Open Salesforce with Access Token, switch to Script view, and choose the script that matches your app's refresh-token policy. Provide SF_CLIENT_ID and SF_CLIENT_SECRET as environment variables for the Katalon Studio process. For a fixed token, also provide SF_REFRESH_TOKEN. Do not print these values or store them in the project.

import static com.kms.katalon.core.testobject.ObjectRepository.findTestObject

import com.kms.katalon.core.testobject.RequestObject
import com.kms.katalon.core.testobject.ResponseObject
import com.kms.katalon.core.webservice.keyword.WSBuiltInKeywords as WS
import com.kms.katalon.core.webui.keyword.WebUiBuiltInKeywords as WebUI
import groovy.json.JsonSlurper

String clientId = System.getenv('SF_CLIENT_ID')
String clientSecret = System.getenv('SF_CLIENT_SECRET')
String refreshToken = System.getenv('SF_REFRESH_TOKEN')
assert clientId && clientSecret && refreshToken : 'Set SF_CLIENT_ID, SF_CLIENT_SECRET, and SF_REFRESH_TOKEN'

RequestObject request = (RequestObject) findTestObject('Object Repository/Retrieve Bearer Token using Refresh Token',
        [('clientId'): clientId, ('clientSecret'): clientSecret, ('refreshToken'): refreshToken])
ResponseObject response = WS.sendRequest(request)
WS.verifyResponseStatusCode(response, 200)
Map tokens = (Map) new JsonSlurper().parseText(response.getResponseText())
String instanceUrl = tokens.get('instance_url')
String accessToken = tokens.get('access_token')
WebUI.openBrowser("${instanceUrl}/secur/frontdoor.jsp?sid=${accessToken}&retURL=%2Flightning%2Fpage%2Fhome")
  1. Save and run the test case. Salesforce should open without its login page or a verification code. For a manual check, open https://yourdomain.my.salesforce.com/secur/frontdoor.jsp?sid= followed by a newly issued access token in a private browser window. The access token appears in the Open Browser URL and may be visible in execution logs; restrict access to those logs.

Automate Salesforce test cases​

The sample project still opens the Salesforce login page and uses USERNAME and PASSWORD in its Default profile. Adapt its test cases before running them with the token-based login above:

  1. Go to Project > Settings > Test Design > Web UI and change the priority of XPath locators, if the recorded objects need it.

    XPath locator priority in Katalon Studio project settings

  2. If Chrome shows a Show Notification prompt, go to Project > Settings > Desired Capabilities > WebUI > Chrome. Set prefs to a dictionary containing profile.default_content_setting_values.notifications with integer value 2. See Set up Desired Capabilities for WebUI Testing.

  3. Use the Record Web utility in Katalon Studio to record Salesforce actions, then save the objects and test cases.

  4. At the start of each test case, replace the recorded browser-opening and username/password login steps with a call to the access-token test case. In Script view, add:

    import static com.kms.katalon.core.testcase.TestCaseFactory.findTestCase
    import com.kms.katalon.core.webui.keyword.WebUiBuiltInKeywords as WebUI

    WebUI.callTestCase(findTestCase('Test Cases/Open Salesforce with Access Token'), [:])

    Adjust the repository path if you saved the test case in a folder. Keep the Salesforce actions after this call.

  5. Run the tests and inspect the results.

Troubleshooting​

ProblemSolution
After login, the browser shows the Salesforce home page and no code.Set the callback URL to /services/oauth2/success as described in Create a Salesforce app.
The authorization request returns 200 and a login page instead of 302.Clear Follow redirects in the request.
The address bar shows an error about a code challenge.Follow the PKCE step in Get a refresh token for each test user.
redirect_uri_mismatchMatch redirect_uri exactly to the app's callback URL.
invalid_grant with expired authorization codeGet a new code and send the token request right away; each code works once.
The token response has no refresh_token.Add Perform requests at any time (refresh_token, offline_access) to the app's scopes.
invalid_grant when you refresh a token a second timeIf your app uses rotation, use the Rotating refresh token script in Open Salesforce with an access token.
Was this page helpful?

Table of Contents