Application credentials

Application credentials are your own OAuth app’s client ID and secret, registered on a Connector so employees authorize your app instead of Merge’s. Add them for your own branding on the consent screen, rate limits scoped to your traffic, or a narrower scope set. Connectors marked Action required need them before anyone can authenticate.

Add application credentials

1. Open the Connector in Connectors, go to Application Credentials, and click Add credential
2. Copy the OAuth callback URL from the dialog and register it in your provider-side OAuth app
3. Pick the authentication method and paste your client ID and secret
4. Set scopes if the Connector supports it, and save

The default callback URL is https://wf-api.merge.dev/link/oauth/callback. Copy the exact value from the dialog, since orgs on their own Merge domain get a different one.

Leave External ID blank unless you keep more than one OAuth app for the same Connector. Existing employee tokens switch to the new app when they refresh. Deleting a credential forces its employees to reconnect.

Use a callback URL on your own domain

Use this when a provider shows the callback’s domain on the consent screen, mainly Google. It works only with your own OAuth app.

1. Host an endpoint on your domain, such as https://auth.acme.com/merge/callback, that forwards the code and state query parameters verbatim to https://wf-api.merge.dev/link/oauth/callback. A 302 is enough.
2. Add that URL to your provider-side OAuth app, and add your domain to the provider’s authorized domains
3. Contact Merge with the Connector and URL. Merge sets it, since it isn’t editable in the dashboard.

Example: Google (Workspace, Drive, Calendar, Gmail)

1. In the Google Cloud Console, go to APIs & Services → Credentials
2. Click Create credentials → OAuth client ID, type Web application
3. Add https://wf-api.merge.dev/link/oauth/callback to Authorized redirect URIs
4. Enable the APIs you need under APIs & Services → Library
5. Configure the OAuth consent screen
6. Paste the client ID and secret into each Google Connector you use. Drive, Gmail, and Calendar are configured separately.

External apps need Google verification; internal apps don’t. With the default callback, Google’s consent screen shows “merge.dev” until your brand is verified, so set up a callback on your own domain.

Example: Microsoft (Outlook, OneDrive, SharePoint, Teams)

1. In the Azure portal, go to Azure Active Directory → App registrations → New registration, single-tenant
2. Add https://wf-api.merge.dev/link/oauth/callback as a redirect URI under the Web platform
3. Under Certificates & secrets, create a client secret and copy it now
4. Under API permissions, add the Microsoft Graph permissions you need and grant admin consent
5. Paste the Application (client) ID and secret into each Microsoft Connector you use

Example: Salesforce

1. Go to Setup → App Manager → New Connected App
2. Enable OAuth and add https://wf-api.merge.dev/link/oauth/callback as a callback URL
3. Pick scopes. api, refresh_token, and offline_access cover most cases.
4. Save, then wait 10 minutes for Salesforce to provision the app
5. Paste the Consumer Key and Consumer Secret into the Connector

Production uses login.salesforce.com and sandbox uses test.salesforce.com. Match the Connector’s environment.

Customize OAuth scopes

Edit scopes in the same dialog, with Reset to defaults to revert. Requires the Manage credentials permission. Changes apply on each token’s next refresh.

Rotate a client secret

Update the secret in Workforce first, then rotate it at the provider. The reverse order makes every employee’s token refresh fail until Workforce has the new secret.