Salesforce
Bag of words enumerates the org’s queryable objects — standard and custom__c — filtering out system and plumbing objects (sharing rows, field history, change events, Chatter feeds). Reference fields become foreign keys. Discovery is capped at 500 objects, with common CRM objects (Account, Contact, Lead, Opportunity, Case, and so on) prioritized so they always survive the cap. A single query returns at most 10,000 rows.
Before you start (JWT bearer)
The recommended path is a Connected App using the OAuth 2.0 JWT bearer flow: a certificate signs a short-lived assertion that is exchanged for an access token. No interactive login, no stored password.1
Generate a key pair
Create an RSA private key and a matching X.509 certificate. Keep the private key (PEM) — you will paste it into Bag of words.
2
Create the Connected App
In Salesforce Setup → App Manager → New Connected App, enable OAuth settings, tick Use digital signatures, and upload the certificate.
3
Copy the Consumer Key
From the Connected App’s detail page, copy the Consumer Key — this is the OAuth
client_id.4
Pre-authorize the service account user
Set the Connected App’s OAuth policy to Admin approved users are pre-authorized, then grant the profile or permission set of the Salesforce user Bag of words will authenticate as.
Fields
Authentication modes
Both modes are system-scope — one shared credential for the whole connection. Connected App (JWT Bearer) —jwt (the default)
Username / Password —
userpass (legacy SOAP login)
NetSuite
Bag of words queries NetSuite with SuiteQL over the REST API (https://<account>.suitetalk.api.netsuite.com/services/rest/query/v1/suiteql), signing each request with OAuth 1.0a HMAC-SHA256 — NetSuite’s Token-Based Authentication (TBA). Results are paged automatically.
Before you start
1
Enable the features
In NetSuite Setup → Company → Enable Features → SuiteCloud, enable REST Web Services and Token-Based Authentication.
2
Create an integration record
Setup → Integration → Manage Integrations → New. Enable Token-Based Authentication. On save, NetSuite shows the Consumer Key and Consumer Secret once — copy both.
3
Create an access token
Setup → Users/Roles → Access Tokens → New, choosing the integration record, the user, and a role with permission to run SuiteQL against the records you want. NetSuite shows the Token ID and Token Secret once — copy both.
Fields
Authentication
Token-Based Auth —token (system scope, the only mode)
ServiceNow
The ServiceNow connector is in beta.
/api/now/table/{table}). Schema discovery reads ServiceNow’s own metadata tables in bulk — sys_db_object for tables and inheritance, sys_dictionary for fields — so a full snapshot takes a handful of requests rather than one per table. Reference fields become foreign keys.
Fields
Authentication modes
Username / Password —userpass (scopes: system and user)
Sign in with ServiceNow —
oauth (scope: user, no fields). Each user signs in against the instance’s own endpoints (/oauth_auth.do, /oauth_token.do) with the useraccount scope, so queries run with that person’s own ServiceNow permissions. This requires the oauth_client_id above to be configured on the connection.
Per-user authentication on a database-style connection requires an Enterprise license. See Authentication and access.
Monday data
The Monday data connector is in beta.
items_page calls with cursor pagination. A single query returns at most 10,000 rows. Filters on status and dropdown columns accept the human-readable label (for example "Done"); the connector translates it to the label index that monday’s API actually matches on. Values come back typed: numbers as floats, checkboxes as booleans, ratings as integers, everything else as display text. Every result also carries three built-in columns — item_id, name (the item name) and group — regardless of which columns the query selects.
This is separate from the Monday MCP preset, which exposes monday.com as callable tools (create an item, post an update). Use this connector when you want boards indexed and queryable as data; the two can coexist.
Fields
Authentication modes
API Token —api_token (scopes: system and user)
Sign in with monday.com —
oauth (scope: user, no fields). Each user signs in against auth.monday.com with read-only scopes (me:read boards:read workspaces:read users:read account:read) — enable exactly these on the app in monday’s Developer Center, since monday rejects the authorize request if any requested scope is missing. Queries run with that person’s own board permissions. This requires the oauth_client_id above to be configured on the connection. monday access tokens do not expire and no refresh token is issued.
Per-user authentication on a database-style connection requires an Enterprise license. See Authentication and access.
PostHog
The PostHog connector is in beta.
events, persons, sessions, and related tables — rather than introspecting the instance.
Fields
Authentication
Personal API Key —api_key (scopes: system and user)
Because this mode is available at user scope as well as system scope, each user can supply their own personal API key instead of sharing the admin’s. Per-user credentials on a database-style connection require an Enterprise license — see Authentication and access.
Priority ERP
The Priority ERP connector is in beta.
ORDERS, CUSTOMERS and PART become queryable tables. The whole tenant schema comes back from one $metadata request rather than a per-object crawl.
Column names alone would be unreadable, so the catalog uses Priority’s own business vocabulary: the human label of each column comes from its Priority.OData.Description annotation. Those titles follow the environment language — a Hebrew tenant returns Hebrew titles — so form names are always the identifiers and titles are only ever descriptions.
Fields
Custom fields appear only once REST metadata has been rebuilt for that form inside Priority. If a column you expect is missing, rebuild the form’s metadata in Priority and re-index the connection.
Authentication modes
Personal Access Token —pat (the default; scopes: system and user)
This is Priority’s own recommendation for server-to-server clients, and the only mode available in both Cloud and on-premise. At user scope it is bring-your-own-token: in Priority Cloud there is no OAuth, so it is the only per-user path.
API Username / Password —
basic (scopes: system and user)
Sign in with Priority (on-prem) —
oauth (scope: user, no fields). Per-user delegated OAuth, on-premise only — Priority scopes its OAuth 2.0 guide to non-SaaS installations, and it requires the paid External ID module plus an external identity provider. Endpoints are derived per-tenant from the service root. This requires the oauth_client_id above to be configured on the connection.
Per-user authentication on a database-style connection requires an Enterprise license. See Authentication and access.