How the connection works

• Authentication. Mercura signs in to your External Client App with OAuth 2.0 (client credentials flow). Salesforce runs every call as the app's Run-As user, so Mercura sees and writes exactly what that user may. There is no interactive login and no refresh token. Mercura stores the consumer secret encrypted.
• Polling. Every five minutes Mercura checks through the Salesforce REST API which records have changed. Only records that change after a data flow is switched on are taken in; Mercura does not import older records retroactively.
• No credentials in Salesforce. No Mercura key is stored in your org, and no Mercura triggers or scheduled jobs run there.
• Sandbox and production. A sandbox is connected the same way; its My Domain URL contains .sandbox. We recommend connecting a sandbox to a Mercura test organisation first.