This guide is for Workday administrators who need to configure authentication for the Zapier Workday integration. This setup is required before users in your organization can connect Workday to Zapier.
The integration supports two authentication methods:
- OAuth 2.0 (required): Handles REST API requests, read operations, triggers, and searches.
- Integration System User (ISU) (optional): Required for SOAP-based actions that create or modify records.
OAuth 2.0 setup
OAuth 2.0 is required for all Workday connections to Zapier. Register an API client in Workday and provide your users with the credentials they need.
1. Register an API client in Workday
- Log in to Workday as a user with administrative permissions.
- Search for
Register API Clientin the Workday search bar. - Open the task.
-
Fill in the required fields:
-
Client Name: Enter a descriptive name (for example,
Zapier Integration). - Client ID: Workday generates this automatically, or you can specify a custom value.
- Client Secret: Workday generates this automatically.
-
Redirection URI: Enter
https://zapier.com/dashboard/auth/oauth/return/App214709CLIAPI/
-
Client Name: Enter a descriptive name (for example,
- Copy the Token Endpoint URL (for example,
https://impl-services1.wd12.myworkday.com/ccx/oauth2/mytenant/token). - Copy the Authorization Endpoint URL (for example,
https://impl-services1.wd12.myworkday.com/ccx/oauth2/mytenant/authorize). - (Recommended) In the Scope or Functional Areas section, select only the functional areas your integration needs. This limits the OAuth token's access to specific Workday domains (for example, Worker Data, Time Tracking, or Procurement).
- Click Submit to create the API client.
- Save the Client ID and Client Secret.
Learn more in Workday's documentation about registering an API client and managing API client access (scopes).
2. Provide credentials to your users
Share the following six credentials with each user who needs to connect Workday to Zapier:
- Client ID: From the API client registration in step 1.
- Client Secret: From the API client registration in step 1.
-
Base URL: The first part of your Workday REST API endpoint (for example,
https://impl-services1.wd12.myworkday.com). -
Tenant: The last part of your Workday REST API endpoint (for example,
mytenant). - Token Endpoint: The token endpoint URL from step 1.
- Authorization Endpoint: The authorization endpoint URL from step 1.
The Base URL and Tenant come from your Workday REST API endpoint. For example, if your endpoint is https://impl-services1.wd12.myworkday.com/ccx/api/v1/mytenant, the Base URL is https://impl-services1.wd12.myworkday.com and the Tenant is mytenant.
3. Set OAuth user permissions
The user who authorizes the OAuth connection needs appropriate permissions for the operations they want to perform. For read-only operations, minimal permissions are sufficient.
To avoid granting excessive permissions to individual users, use ISU credentials for write operations. Refer to the ISU setup section for details.
Once you complete these steps, users in your organization can connect Workday to Zapier with OAuth 2.0.
ISU setup
Integration System User (ISU) credentials are required for any actions that create or modify records in Workday using the SOAP API. ISU provides fine-grained permission control, data scope restrictions, and clear audit trails.
NoteComplete the OAuth 2.0 setup first. ISU is an additional layer on top of OAuth 2.0, not a replacement.
1. Create an Integration System User
- Log in to Workday as a user with Setup: Tenant Setup - Security and Security Administration permissions.
- Search for
Create Integration System Userin the Workday search bar. - Open the task.
-
Fill in the required fields:
-
User Name: Enter a descriptive username (for example,
zapier-hr-teamorzapier-finance-team). - Password: Set a strong password.
-
Description: Enter a description that explains the purpose (for example,
Zapier integration user for HR team workflows).
-
User Name: Enter a descriptive username (for example,
- Click Submit to create the ISU user.
2. Grant permissions to the ISU user
- Search for
Maintain Integration System Securityin Workday. - Select the ISU user you created.
-
Grant only the specific domain permissions needed for your integration, for example:
- Worker Data: Employee-related operations (hire, terminate, change job).
- Time Tracking: Time off requests and time entry operations.
- Recruiting: Job requisitions and candidate operations.
- Procurement: Supplier and invoice operations.
- Financials: Financial data.
- Payroll: Payroll data.
-
For each domain, grant only the specific operations needed:
- Get: Read access.
- Put: Update access.
- Post: Create access.
- Delete: Delete access (rarely needed).
- Click Submit to save permissions.
3. Configure data scope (recommended)
Limit data access for different teams by configuring the ISU user's data scope:
- Search for
Maintain Integration System Securityin Workday. - Select your ISU user.
-
Configure Domain Policies to restrict access:
- Organization restrictions: Limit to specific organizations or organizational units.
- Worker restrictions: Limit to specific worker populations (for example, exclude executives or contractors).
- Location restrictions: Limit to specific locations or regions.
- Company restrictions: Limit to specific companies.
- Click Submit to save data scope restrictions.
For sensitive data domains (Payroll, Financials), consider excluding these domains entirely for non-finance teams and creating separate ISU users with specific access for finance and payroll teams.
4. Provide ISU credentials to your users
Share the following two credentials with each user who needs ISU access:
- ISU username: The username you created in step 1.
- ISU password: The password you set in step 1.
ISU credentials are optional. If you do not provide them, actions that create or modify records using the SOAP API will not be available, but REST-based read operations will still work using OAuth 2.0.
Once you complete these steps, users in your organization can connect Workday to Zapier with both OAuth 2.0 and ISU credentials.
Best practices: team-based ISU setup
For enterprise environments, create separate ISU users for each team with appropriate data scopes.
- Purpose: Handle employee lifecycle operations without access to financial data.
-
Permissions:
- Worker Data: Get, Put, Post (for hire, terminate, change job).
- Time Tracking: Get, Put, Post (for time off requests).
- Recruiting: Get, Put, Post (for job requisitions).
- Data scope restrictions: Exclude Payroll and Financials entirely; limit to HR organizational units only.
- Purpose: Handle supplier and invoice operations with access to financial data.
-
Permissions:
- Procurement: Get, Put, Post (for supplier and invoice operations).
- Financials: Get (for financial reporting).
- Payroll: Get (for payroll reporting, if needed).
- Data scope restrictions: Limit to finance organizational units; include payroll data only when needed for reporting.
- Purpose: Handle payroll-specific operations.
-
Permissions:
- Payroll: Get, Put, Post (for payroll operations).
- Worker Data: Get (for worker information needed for payroll).
- Data scope restrictions: Limit to payroll organizational units only; exclude other sensitive domains you do not need.
Troubleshooting
- Verify the Client ID and Client Secret are correct.
- Check that the Token Endpoint and Authorization Endpoint URLs are correct.
- Ensure the Base URL and Tenant values match your Workday REST API endpoint.
- Verify the ISU username and password are correct.
- Check that the ISU user has the required permissions for the operation.
- Ensure the ISU user has not been deactivated in Workday.
- Check that the OAuth user (for read operations) or ISU user (for write operations) has the required permissions.
- Verify domain permissions are granted correctly in Workday.
- Check that data scope restrictions are not blocking access to the required data.
Learn more in Workday error: Permission denied.
- Ensure ISU credentials have been entered in the Zapier connection settings.
- Verify both ISU username and password are provided (both are required).
- Check that the ISU user has the necessary permissions for the action.