PKCE OAuth flow. Production or Sandbox, either works — sandbox has one extra checkbox.
API Enabled on your profile.login.salesforce.com for production, test.salesforce.com for sandbox). Sign in.api and refresh_token offline_access — enough to read and write Contacts, Leads, Campaigns, and CampaignMembers.yourco.my.salesforce.com).On registration approval, we match the registrant by email. If a Contact exists we update it; if not, we look for a matching Lead; if neither, we create a new Lead. Attendance is recorded as a CampaignMember on a Campaign we create per event (idempotent — two registrations against the same event land on the same Campaign).
On Campaign create we also provision three CampaignMember statuses so your reports read cleanly: Registered, Attended, Cancelled. If your org has customized the default statuses, ours coexist alongside yours.
API Enabled permission on the profile you signed in with. It's off by default only on the strictest custom profiles.INVALID_FIELD_FOR_INSERT_UPDATE. A custom field on the Contact or Lead is not writable by the API user. We already fall back to only the standard fields on this error, so the contact still lands — the sync log records which field was rejected so your Salesforce admin can fix the field-level-security setting.