Agent API Integration Review

Use This Skill When

• Reviewing an Agent API integration before it ships.
• Auditing an existing client for security, correctness, and resilience gaps.
• Producing a prioritized risk list for an Agentforce headless/chat integration.

Review Checklist

Authentication and secrets

• Consumer secret and token are server-side only; not in the browser or source control.
• Token refresh handled (proactive + on 401); no static/pasted tokens.
• ECA uses client credentials flow with the required scopes (api, refresh_token/offline_access, chatbot_api, sfap_api).
• Run As user has appropriate (least-privilege) access; bypassUser chosen deliberately.

Endpoints and environment

• instanceConfig.endpoint uses the My Domain URL, not the Lightning URL.
• Correct base host (api.salesforce.com, or api.gov.salesforce.com for Government Cloud).
• Agent is not type "Agentforce (Default)".