Oddeven Lead Routing for Salesforce

Oddeven Lead Routing connects your WordPress forms to Salesforce and keeps the connection
working through the 2026 and 2027 authentication changes.

Built for the auth Salesforce actually supports. Salesforce restricted new
Connected App creation in Spring ’26 and retires the OAuth username-password flow in
Winter ’27. Oddeven Lead Routing is built on External Client Apps with the client credentials
flow, so a connection you set up today is still a supported configuration afterwards.
The username-password flow is not implemented, and never will be.

A submission is saved before it is sent. Every submission is written to the
database with a pending status before any outbound call, then delivered by a
background worker through Action Scheduler. A Salesforce outage, a slow API or a
validation error cannot break your form or lose the lead. Failed deliveries are
retried with backoff and, if they keep failing, land in a dead letter list you can
inspect and requeue.

Credentials are encrypted at rest. Client secrets and tokens are protected with
libsodium authenticated encryption, keyed from a constant you define in
wp-config.php.

No phoning home. The plugin talks to your Salesforce org and nothing else. No
telemetry, no analytics, no licensing service.

Features

• Map form fields to any Salesforce object over the REST API
• Web-to-Lead and Web-to-Case as alternatives when you cannot use the API
• Per feed conditional logic
• Delivery log with retry, dead letter handling and manual requeue
• Ten granular capabilities, so watching the submission queue does not require the
  right to edit Salesforce credentials

Supported forms

• Contact Form 7

Requirements

• WordPress 6.8 or newer
• PHP 8.0 or newer with the sodium extension
• The ability to add one line to wp-config.php, which holds the encryption key
• A Salesforce org where you can create an External Client App

External services

This plugin connects to Salesforce, and to nothing else. It contacts no service
operated by us, sends no telemetry, and transmits nothing at all until you have
configured a connection and connected a form to it. A visitor loading a page never
causes an outbound request.

Your Salesforce org

The Salesforce org you connect, at the My Domain address you supply, for example
https://yourcompany.my.salesforce.com. It is used to obtain an OAuth access token, to
read the object and field list so you can map fields to it, and to create records from
form submissions.

What is sent, and when:

• Your External Client App’s consumer key and secret, when an access token is requested
  — when you connect, when you use “Test connection”, and when a token expires.
• The name of the Salesforce object you chose and a field list request, when you open
  the mapping editor.
• The form field values you have mapped, when a queued submission is dispatched. Only
  the fields named in your mapping are sent; nothing else from the submission is.

Salesforce Web-to-Lead and Web-to-Case

Used only if you choose that delivery method for a form, instead of the API.

• https://webto.salesforce.com/servlet/servlet.WebToLead for production orgs
• https://test.salesforce.com/servlet/servlet.WebToLead for sandboxes

Your Salesforce organisation id and the mapped form field values are sent when a
queued submission is dispatched.

Salesforce sign-in

Used only if you choose the browser sign-in method when creating a connection. Your
browser is sent to https://login.salesforce.com, https://test.salesforce.com or your
own My Domain address to authorise the plugin, and the resulting authorization code is
exchanged there for an access token.

All three are provided by Salesforce, Inc. Terms of service:
https://www.salesforce.com/company/legal/agreements/ . Privacy policy:
https://www.salesforce.com/company/legal/privacy/ .