OAuth or Open authorisation is a secure protocol where apps can gain limited data from a user without the use of a password.
Helpful Hint
Anyone can build an application to interact with payroll, but they will still need to log in and give permission for the application to view data. Applications cannot access data not available to the user who is not logged in.
With that, access would only be based on what the user has access to on the platform. If a full-access user is the requestor, there will not be any restrictions on access. That being said, third party applications are not within our scope of support, so as such, ask your IT department to assist with setting up restrictions, if possible.
How this works in your payroll account
A client with client credentials grant enabled can request access tokens for any users (including admin users) without providing identity authentication (i.e. password). With a valid access token for a user, the client can access what the user can access and make API calls that are logged against the user. This grant type should NOT be granted frivolously.
Request an access token
Make a POST request to https://api.yourpayroll.com.au/oauth/token to obtain your access tokens.
The following parameters are required:
- client_id: The client ID that you were provided above in Obtaining OAuth credentials.
- client_secret: The client secret that you were provided above in Obtaining OAuth credentials.
- redirect_uri: The URI that you specified when requesting your OAuth credentials.
- grant_type: This field must contain a value of client_credentials, as defined in the OAuth 2.0 specification.
- audience: The audience must follow this format
{
"kp_username": "string",
"kp_business_id": "string",
"eh_organisation_id": "string",
"eh_member_id": "string"
}A successful response contains the following fields in a JSON result similar to the following:
{
"access_token":"string",
"token_type": "bearer",
"expires_in": 86400,
"scope": "eh_access_token"
}Note: The access tokens are currently set to expire every 24 hours. You can request for a new access token by making another POST request following the above instructions.