> ## Documentation Index
> Fetch the complete documentation index at: https://wisty.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Install Wisty
> Install the Salesforce package, assign builders, and make the Wisty tab available to viewers.
Open **Install package** from Wisty's Salesforce connection dialog to add Wisty to your org. You need Salesforce admin access, and you only install it once per org.
The package includes Wisty's [External Client App](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm), the **Wisty** tab, the **Wisty App** component for Lightning pages, and the **Wisty Builder** permission set. It adds no custom objects.
```mermaid actions={false} theme={null}
---
config:
theme: base
themeVariables:
fontFamily: inherit
fontSize: 15px
lineColor: "#8C817A"
edgeLabelBackground: "#FFFFFF"
flowchart:
nodeSpacing: 24
rankSpacing: 32
padding: 12
curve: basis
---
flowchart LR
accTitle: Salesforce setup sequence
accDescr: A Salesforce admin installs the package, assigns builders, and shows the Wisty tab to viewers. A Wisty team admin then connects the host org, and builders share apps with it.
I("Install
the package"):::app
B["Assign
builders"]:::input
T["Show the
Wisty tab"]:::input
H["Connect the
host org"]:::input
P["Share
an app"]:::input
I --> B --> T --> H --> P
classDef input fill:#F5F3F0,stroke:#D6CFC8,color:#51463F,stroke-width:1px;
classDef process fill:#FFF1E8,stroke:#D94400,color:#8A2C0D,stroke-width:1.5px;
classDef app fill:#FFF1E8,stroke:#D94400,color:#8A2C0D,stroke-width:2px;
classDef data fill:#EFF6F1,stroke:#8AA995,color:#315640,stroke-width:1px;
classDef blocked fill:#FFFFFF,stroke:#B9ADA3,color:#8C817A,stroke-width:1px,stroke-dasharray:4 3;
linkStyle default stroke:#8C817A,stroke-width:1.5px;
```
## Install the package
In Wisty, open **Connected orgs** and start **Connect Salesforce org**. A Wisty team admin can also start from **Host orgs**, then **Add host org**.
In step 1 of the dialog, click **Install package**.
Choose **Production**, **Sandbox**, or **Custom domain** to match the org where you're installing. For a custom domain, enter the My Domain name shown before `.my.salesforce.com`.
Click **Install in Salesforce** and sign in as a Salesforce admin. Choose **Install for Admins Only** and complete the Salesforce installer.
When installation finishes, click **Continue in Wisty** to return to setup.
Choose **Install for Admins Only** unless you've deliberately chosen specific
builder profiles. **Install for All Users** grants the package's **Wisty:
Build Apps** permission to every profile, allowing those users to build and
spend credits. Viewers don't need this permission.
**Install for Admins Only** grants the builder permission to the System Administrator profile. Other builders can receive it through the permission set below. If you already installed for all users, review **Custom Permissions** on those profiles and remove **Wisty: Build Apps** where it isn't needed.
If you're building from your Wisty account, continue with [Connect Salesforce](/docs/getting-started/connect-salesforce). To let people use Wisty inside Salesforce, complete the access steps below, then [connect the host org](/docs/salesforce-setup/connect-host-org).
## Assign builders
Give this access only to people who should create projects and publish apps inside Salesforce.
1. In Salesforce **Setup**, open **Permission Sets**.
2. Select **Wisty Builder**.
3. Click **Manage Assignments** and add the users who should build.
4. Have those users open Wisty again to pick up their new role.
The permission set contains **Wisty: Build Apps** and makes the **Wisty** tab visible. It doesn't grant access to Salesforce records. Each person's existing Salesforce data permissions still apply.
If you use your own permission sets, add the **Wisty: Build Apps** custom permission there instead. [Manage builders and viewers](/docs/salesforce-setup/control-access) explains how this differs from Wisty web team membership.
## Show the Wisty tab to viewers
Viewers don't need **Wisty Builder**. They do need tab visibility to open the app launcher, because an admin-only install leaves the packaged tab hidden from other profiles.
Choose one way to make the tab available:
Open **Setup**, then **Profiles**. Select the profile, open **Object Settings**, select **Wisty**, and set **Tab Settings** to **Default On**.
Open the permission set's **Object Settings**, select **Wisty**, and set **Tab Settings** to **Visible**. Assign that set to the viewers.
People opening an app directly on a Salesforce page don't need the Wisty tab. They still need permission to use Wisty's Salesforce External Client App and access to the shared app.
## Finish setup and check a first launch
[Connect the org as a host org](/docs/salesforce-setup/connect-host-org) to link it to your Wisty team and enable sharing.
Then have a viewer open **Wisty** from the Salesforce App Launcher. With the default **All users can self-authorize** policy, they see **Wisty isn't connected yet** the first time. They click **Connect Wisty** and approve access in Salesforce. The approval window closes and Wisty opens in the original tab.
A viewer should reach the app launcher. A builder should also have access to project creation. If the tab or builder controls are missing, see [Fix common problems](/docs/help/troubleshooting).
## What Salesforce authorization allows
Wisty ships a Salesforce External Client App. It requests these OAuth scopes:
| Scope | Purpose |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| API access | Read Salesforce data and perform approved record writes as the person using the app. |
| Refresh token | Keep the connection working after the current Salesforce session. Wisty stores tokens encrypted and refreshes them server-side. |
| Custom permissions | Check **Wisty: Build Apps** when someone opens Wisty through Salesforce, and before they generate or publish. |
The custom-permissions scope is required for Salesforce builders. If Wisty can't confirm the permission, it refuses generation and publishing. [How Wisty uses your data](/docs/security/data-handling) explains what reaches the generating AI and what happens only when an app runs.
## Pre-authorize users
Pre-authorizing lets you choose who can open Wisty inside Salesforce, and those people skip the **Connect Wisty** step.
Open **Setup**, then **External Client App Manager**, and select Wisty's app. Under **Policies**, open **OAuth Policies** and set **Permitted Users** to **Admin approved users are pre-authorized**.
The profile and permission-set pickers appear under **App Policies** once the policy is switched.
Move each profile that should open Wisty to **Selected Profiles** and save.
Create a permission set, for example **Wisty Access**. It can be empty: selecting it here is what grants access. Move it to **Selected Permission Sets**, save, and assign it to everyone who should open Wisty.
If you made a permission set for [Wisty tab visibility](#show-the-wisty-tab-to-viewers), use that one.
Include your builders. Opening Wisty and building are separate grants: builders need this access and **Wisty Builder**.
Salesforce doesn't let a permission set from a managed package be selected
here. Picking **Wisty Builder** fails with `We couldn't save the external
client app` and `state=MANAGED_INSTALLED`. Don't clone **Wisty Builder** to
get around it. A clone carries **Wisty: Build Apps**, so everyone you give
it to can build and spend credits.
Changing this policy doesn't by itself remove earlier authorizations. To remove existing access, review and revoke the user's authorization too. See [Manage builders and viewers](/docs/salesforce-setup/control-access#remove-salesforce-app-access).