How do integrations work?
What connects, where tokens live, and how to disconnect.
01Where they live
Organisation Settings → Integrations lists every connector alongside the state of your connection to it. There is nothing to install or enable first — the catalogue is simply there, and what you may do with it follows your permissions.
02Connect
Xero pushes invoices and syncs contacts; Google Calendar keeps a two-way sync with your bookings. Both are OAuth connectors, so connecting hands you to the provider’s own sign-in page to approve the access — we never see your provider password, and you can see exactly which scopes were asked for.
03Where access lives
The access tokens a provider issues are encrypted and held only on our servers. They never reach your browser and staff cannot read them, which is also why reconnecting is the fix for a broken connection rather than “re-entering the key”.
04Sync and health
Run a sync check at any time to confirm a connection is still healthy; recent results list under each connection, so a provider that quietly revoked access shows up as a failed check rather than as silence.
05Webhooks
Webhooks are the connector for anything with no dedicated integration: register an https endpoint you control and the events you want, and signed payloads are sent to it. Each endpoint gets an HMAC signing secret shown once, at registration. Copy it then — verifying the signature on your side is what proves a payload came from us.
06Who can do what
Running a sync check and reading connection health, managing connections, editing how local fields map onto the provider’s, and managing webhook endpoints are four separate permissions. Seeing the section at all means you can at least check the health of what is connected.
07Disconnect
Disconnecting revokes access at the provider and deletes the stored tokens immediately. Nothing is kept “just in case” — reconnect whenever you want and a fresh approval is asked for.