This step-by-step guide helps you securely connect GPTfy to your own Azure-hosted OpenAI service using BYOK. You’ll configure Azure, Salesforce, and GPTfy to establish a secure, scalable, and compliant integration.
What is a BYOK connection?
BYOK (Bring Your Own Key) connection in GPTfy is a configuration that allows customers to use their own AI service connections instead of using the pre-packaged GPTfy-managed connections.
The documentation outlines the detailed process for creating this connection, which includes:
- Setting up the necessary Azure infrastructure (creating an Azure OpenAI service and deploying models)
- Configuring Salesforce components (External Credentials, Custom Headers, Permission Sets)
- Setting up Named Credentials to securely connect Salesforce to Azure OpenAI
- Configuring GPTfy to use this connection
This functionality is needed for customers who:
- Want to use their own Azure-hosted OpenAI services rather than GPTfy’s managed connections
- Need more control over their AI infrastructure and model deployments
- Have specific security or compliance requirements that necessitate using their own Azure resources
- May have existing investments in Azure OpenAI services they want to leverage
The BYOK approach gives customers more flexibility while still benefiting from GPTfy’s Salesforce integration features and security capabilities.
Prerequisites
1. Azure Setup
Step 1: Create an Azure OpenAI Resource
- Go to the Azure OpenAI Service Create Page.
- Fill in:
- Subscription: Select your Azure subscription
- Resource Group: Choose or create a new one
- Region: Closest to your users (impacts latency)
- Name: e.g., azure-openai-test-001
- Pricing Tier: Only one available – select it
- Click Review + Create → Create
Step 2: Deploy a Model in Azure AI Studio
Navigate to Azure OpenAI Studio
Under Deployments, click + Create new deployment
Choose your model (e.g., gpt-35-turbo, gpt-4)
Name your deployment (e.g., gptfy-deploy)
Save the Endpoint and Key 1 for later
2. Salesforce Setup
Note- These steps configure secure callouts from Salesforce to Azure using Named Credentials and External Credentials.
Step 1: Create an External Credential
- Go to Setup → External Credentials
- Click New
- Fill in:
- Label: OpenAIOnAzure
- Name: OpenAIOnAzure
- Authentication Protocol: Custom
Step 2: Create a Principal
Under the External Credential, go to the Principals related list
Click New
Fill in:
Parameter Name:
AzureOpenAI_Principal
Authentication: Leave blank
Sequence: 1
Save
Step 3: Create a Custom Header
- Under the External Credential, go to the Custom Header
- Click New
- Fill in:
- Name: Authorization
- Value: ‘KEY 1’ from Azure into Salesforce.
- Sequence: 1
- Save
Step 4: Create a Permission Set
- Go to Setup → Permission Sets
- Create one named GPTfy_Azure_Permission
In the External Credential Principal Access section:
Select the appropriate Available External Credential Principal and save.
Define clear prompts or instructions tailored to your specific needs.
Step 5: Create a Named Credential
- Go to Setup → Named Credentials
- Click New
- Fill in:
- Label: GPTfyAzureOpenAI
- URL: Your Azure OpenAI endpoint (e.g., https://gptfy-resource.openai.azure.com)
- Identity Type: Named Principal
- Authentication Protocol: Custom Header Authentication
- External Credential: Select AzureOpenAI_Credential
- Allowed Callouts From: ccai (GPTfy package namespace)
- Save
3. GPTfy Configuration
Step 1: Create the Model Connection
- Open the GPTfy Cockpit in Salesforce
- Click on AI Models
- Click + New → Select Create Your Own
Step 2: Fill in Info Tab
- Model Name: Azure OpenAI
- Description: BYOK connection to Azure-hosted OpenAI
- Icon Source: SLDS Icon or Static Resource
- Sequence: e.g., 5
Save and proceed to Connection Details.
Step 3: Fill in the Connection Details Tab
| Field | Description |
|---|---|
|
AI Technology
|
OpenAI
|
|
Platform |
Azure |
|
Version |
gpt-35-turbo or gpt-4 |
|
Temperature |
0.7 (or your preferred level of randomness) |
|
Top P |
Specify if this is a Voice, Chat, or Standard model. |
|
Top P
|
1 |
|
Max Output Tokens |
1000 (or per your needs) |
|
Named Credential |
GPTfyAzureOpenAI (created earlier) |
|
EndPoint URL |
/openai/deployments/[deployment-name]/completions?api-version=2022-12-01 |
- Click Activate
Step 4: Test the Integration
- Open a Salesforce record (e.g., Account)
- Ensure a prompt is linked to the model
- Use the GPTfy Console:
- Select the prompt
- Click Run GPTfy
- Review the response and check audit logs for validation
Troubleshooting
| Issue | Resolution |
|---|---|
|
Named Credential errors
|
Ensure Principal and Custom Header is assigned to the External Credential
|
|
Key not accepted
|
Double-check that the header name is api-key |
|
Prompt doesn’t show
|
Confirm the prompt is active and mapped to this model |
|
Callout errors |
Validate that the allowed namespace is set to ccai in Named Credential |
Bonus: Configure Azure RAG Model in GPTfy
Once your Azure OpenAI and Salesforce configurations are complete, you can optionally enable GPTfy’s Azure RAG (Retrieval-Augmented Generation) model. This allows you to enrich prompts with external data sources for more contextual responses.
Take it a step further with GPTfy’s Azure RAG (Retrieval-Augmented Generation) integration.
Step 1: Create Azure RAG Model in GPTfy
- Go to Cockpit → AI Models
- Click Azure RAG → Edit Info tab
- Provide name, icon, and sequence number
Step 2: Setup Credentials (Same as Above)
Repeat the steps in Salesforce Setup:
Create External Credential
Add Principal and Custom Header
Create a Named Credential using the Azure endpoint
Ensure:
Header key is api-key
Namespace is ccai
Permission Set is assigned
Step 3: Activate the RAG Model
Once credentials and connection are set, activate the Azure RAG model. This model can now be used across prompts to bring in external data contextually.
By completing this setup, you’ve enabled GPTfy to securely use your Azure OpenAI deployment while preserving compliance and maintaining full control over your AI infrastructure.