When a call enters Amazon Connect, Amazon Connect opens a real-time connection to Salesforce and routes the call to the Agentforce agent. To secure the connection, Amazon Connect sends an API key (referred to by Salesforce as a JWT token) and stores it in AWS Secrets Manager. The token authenticates requests from your Amazon Connect instance. Authentication steps vary depending on whether you use Salesforce Voice with Telephony Providers.
Websocket Authentication for Salesforce Voice with Telephony Providers Customers
If you are a Salesforce Voice with Telephony Providers customer, Salesforce provides the
JwtTokenRotatorFunction Lambda Function, starting in
contact center version 22.1. This function can generate a contact-center-based or
messaging-channel-based token. The function runs every 55 minutes and writes a new 60-minute
token to <identity>-salesforce-jwt-secret. When you register the
agent-to-agent application that points Amazon Connect to the Agentforce WebSocket URL, use
that secret’s Amazon Resource Name (ARN).
WebSocket Authentication for non-Salesforce Voice with Telephony Providers Customers
If you aren’t a Salesforce Voice with Telephony Providers customer, deploy
SalesforceJwtRotatorNonScvStack, a standalone CloudFormation stack, in
the same AWS account and region as the instance. The stack signs a new JWT on a schedule and
stores it for Amazon Connect. Set the instance ID, the org ID, and the Call Center or
Messaging channel name. After the stack is created, replace the private-key placeholder. The
token for this instance includes the roles claim set to
voiceagent. After the rotator runs, use the ARN of
<identity>-salesforce-jwt-secret when you register the
agent-to-agent application.
The stack creates these resources.
- KMS key. A customer-managed AWS Key Management Service (KMS) key encrypts the secrets. The key policy allows your account root, and it allows Amazon Connect to decrypt for this instance only.
- Secrets.
<identity>-salesforce-secretstores the org ID, the Call Center or Messaging channel name, and the private key.<identity>-salesforce-jwt-secretstores the current JWT. - JwtTokenRotatorFunction. An EventBridge rule runs this Lambda function every 55 minutes. Each run signs a new RS256 JWT and writes it to the JWT secret.
- SecretConfigurator. This Lambda function fills in the secrets during deployment and keeps a private key you already set when you update the stack. The stack also creates the IAM roles and the Lambda layer the functions use.
- Configure Authentication If You Are a Salesforce Voice with Telephony Providers Customer
If you are a Salesforce Voice with Telephony Providers customer, Salesforce manages the token for you. TheJwtTokenRotatorFunctionLambda function runs every 55 minutes and writes a new 60-minute token to<identity>-salesforce-jwt-secret. - Configure Authentication If You Aren’t a Salesforce Voice with Telephony Providers Customer
If you aren’t a Salesforce Voice with Telephony Providers customer, deploy the SalesforceJwtRotatorNonScvStack CloudFormation stack to the same AWS account and region as the instance. Set the instance, org, and channel parameters. After the stack is created, replace the private-key placeholder in the <identity>-salesforce-secret secret with your RSA private key. Then run the rotator and confirm that the JWT secret contains a token before you use its ARN. The rotator generates the token, rotates it every 55 minutes, and writes the latest token into the JWT secret. The stack passes the JWT secret ARN to the contact flow.