Platform Models API Configure

Salesforce Models API setup for an AI coding agent

The Salesforce Models API (https://api.salesforce.com/ai/gpt/v1) is authenticated with a signed OrgJWT (obtained via client_credentials with the sfap_api scope — see scripts/get-orgjwt.sh; no proxy). That auth and the base URL are the same for any agent. How each agent then talks to the endpoint is agent-specific: Anthropic clients (Claude Code and the Claude Agent SDK) route through Bedrock mode (the env vars in Step 3), whereas other agents (e.g. Codex) use their own client config against the same endpoint and token — Bedrock mode does not apply to them.

The steps below are the Claude Code / Claude Agent SDK reference implementation (Bedrock mode + a JSON settings file + an API-key helper). For a non-Bedrock agent, reuse the OrgJWT auth (Step 1) and the base URL, and apply the equivalent client settings in that agent's own config location instead of the Bedrock env vars.

Bundled scripts are in scripts/. Path placeholders below: <SKILL> = the absolute path to this skill's own directory (the folder containing this SKILL.md; resolve it from the skill path in context). <ABS> = the absolute path to the user's project root. Always emit fully resolved absolute paths — the API-key helper runs from an undefined working directory, so relative paths break it.

Prerequisite

A connected app in the org with the sfap_api OAuth scope and the client_credentials flow enabled (consumer key/secret + a run-as user). Setup steps: https://developer.salesforce.com/docs/ai/agentforce/guide/access-models-api-with-rest.html curl + jq installed.

Inputs to collect

• SF_INSTANCE_URL — org My Domain, e.g. https://acme.my.salesforce.com
• SF_CLIENT_ID, SF_CLIENT_SECRET — connected-app consumer key/secret
• Models API base URL: https://api.salesforce.com/ai/gpt/v1
• Model: a fully qualified sfdc_ai__… name, e.g. sfdc_ai__DefaultBedrockAnthropicClaude46Sonnet (full list: https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html)
• Scope: project (<cwd>/.claude/settings.json, default) or user (~/.claude/settings.json) — reference-agent settings paths
• Headers — <FEAT> = x-client-feature-id (default ai-platform-models-connected-app), <APP> = x-sfdc-app-context (default EinsteinGPT). Used in the Step 2 verify curl and in ANTHROPIC_CUSTOM_HEADERS.

Steps (reference implementation)

Concrete values for a JSON-settings + API-key-helper agent. Reuse the OrgJWT auth, verify curl, and base URL verbatim for any agent; adapt the settings-file location and env-var wiring to the target agent.

1. Write <project>/.claude/.orgjwt.env (chmod 600), gitignore it:

   SF_INSTANCE_URL="..."
   SF_CLIENT_ID="..."
   SF_CLIENT_SECRET="..."

2. Verify — must return 200 before writing settings:

   TOKEN=$(bash <SKILL>/scripts/get-orgjwt.sh <ABS>/.claude/.orgjwt.env)
   curl -s -o /dev/null -w '%{http_code}\n' \
     <MODELS_API_URL>/model/<MODEL>/invoke-with-response-stream \
     -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
     -H 'x-client-feature-id: <FEAT>' -H 'x-sfdc-app-context: <APP>' \
     --data '{"anthropic_version":"bedrock-2023-05-31","max_tokens":16,"messages":[{"role":"user","content":"hi"}]}'

3. Write .claude/settings.json (merge into existing; keep other keys):

   {
     "apiKeyHelper": "bash <SKILL>/scripts/get-orgjwt.sh <ABS>/.claude/.orgjwt.env",
     "model": "<MODEL>",
     "env": {
       "ANTHROPIC_AUTH_TOKEN": "",
       "CLAUDE_CODE_USE_BEDROCK": "1",
       "CLAUDE_CODE_SKIP_BEDROCK_AUTH": "1",
       "ANTHROPIC_BEDROCK_BASE_URL": "<MODELS_API_URL>",
       "ANTHROPIC_SMALL_FAST_MODEL": "<MODEL>",
       "ANTHROPIC_DEFAULT_MODEL": "<MODEL>",
       "ANTHROPIC_CUSTOM_HEADERS": "x-client-feature-id: <FEAT>\nx-sfdc-app-context: <APP>"
     }
   }

   Use absolute paths in apiKeyHelper. (<FEAT> / <APP> defaults are in "Inputs to collect" above.)
4. Tell the admin to fully restart the agent (claude for the reference agent) — settings and the API-key helper load at startup only.