Why a service account instead of a person's login

Connect Dynamics 365, NetSuite, HubSpot and Salesforce with a dedicated service account or machine-to-machine app that your company owns, not with one employee's personal login. A personal login stops working the day that person changes their password, is asked for MFA again, goes on leave, changes roles or leaves the company. Many CRMs also expire a personal login's refresh token after a fixed period of inactivity or on a schedule (for example, about every 90 days, or weekly for NetSuite's simple sign-in). When that happens, transcripts and leads stop reaching your CRM until someone signs in again. A service account has no person behind it, so none of those events can break delivery.

What to set up for each CRM

Microsoft Dynamics 365. Register an app in Microsoft Entra ID and connect with its client credentials (Tenant ID, Application (client) ID, Client Secret and your Instance URL). Then create an Application User in Dynamics for that app and give it a security role that can read and write the records Velaro uses. The Application User does not need a Dynamics license and has no password or MFA. Rotate the client secret before it expires. The full walkthrough is in the Dynamics 365 Bot Knowledge Guide.

NetSuite. Use OAuth 2.0 machine-to-machine with a certificate. Velaro generates the certificate in the setup screen and your NetSuite Administrator uploads it once. NetSuite does not expire it weekly, so no one has to sign in again. Use a dedicated integration role (a Web Services Only role) rather than a named employee's role. See the NetSuite Machine-to-Machine Connection Guide. If your connection currently uses Sign in with NetSuite, a Switch to machine-to-machine card appears on Integrations, NetSuite.

Salesforce. Create a dedicated integration user (for example, "Velaro Integration") with only the permissions Velaro needs, and authorize the connected app as that user. Do not authorize it as a sales rep or administrator who may leave. Exempt that user from password expiry if your security policy allows it.

HubSpot. Authorize the connection with a shared, company-owned HubSpot user dedicated to the integration (not a rep's account), and give it only the access Velaro needs. If a rep authorized it and later leaves, reconnect it under the shared user.

Who owns the records Velaro creates

Records created through a service account show that account as the creator. Ownership in your CRM is then decided by your CRM, not by who connected Velaro. The usual pattern is:

1. Set a default owner or a queue for new leads and contacts in your CRM (for example, a "Web Chat" queue in Dynamics, or a default owner in HubSpot or Salesforce).

2. Use your CRM's own assignment rules, workflows or round-robin features to hand the record to the right person or team from that default.

3. If you want Velaro to prefer the person who already owns the contact, turn on Route to CRM Owner for the team. When a visitor matches a CRM record whose owner's email matches an available Velaro agent on your site, that agent is preferred, and anything else falls back to the team's normal routing. This works with HubSpot and Salesforce today. Match owners to agents by using the same email address in both systems.

Checking that your CRM is receiving data

Open the Integrations page and select your CRM to check that the connection shows as connected. If a connection has stopped working, reconnect it there; with a service account this is rarely needed. For how transcripts are sent and when a conversation is skipped, see the Sending Chat Transcripts to Your CRM guide. If a specific transcript is missing from your CRM and you cannot tell why, contact Velaro support with the conversation ID and the time it ended.

Troubleshooting

• Transcripts stopped arriving after working for weeks. If the connection was made with a personal login, reconnect it using a service account as described above.
• Records land on the wrong owner. Set the default owner or queue in your CRM, and check your CRM's assignment rules.
• Route to CRM Owner does not pick the owner. Confirm the owner's email in the CRM matches an agent's email in Velaro and that the agent is Available.