Connect your app to Workday

1. 1

   Ask your Workday administrator (or do it yourself if you have permission) to register a new API client in your Workday system.

   This creates a secure pathway for your Lovable app to talk to Workday. You'll get special codes (Client ID and Client Secret) and web addresses (endpoints) that Lovable needs.

2. 2

   Make sure the API client is set up for 'Authorization Code Grant' and 'Bearer' access tokens, with 'PKCE' disabled, and 'Non-Expiring Refresh Tokens' enabled.

   These settings ensure a secure and long-lasting connection for your app users without frequent re-logins.

3. 3

   Set the 'Redirection URI' in Workday to exactly 'https://connector-gateway.lovable.dev/api/v1/app-users/oauth2/callback'.

   This tells Workday where to send users back after they've successfully logged in and approved access, allowing Lovable to complete the connection.

4. 4

   Choose only the specific 'Functional Areas' (like 'Staffing' for worker data) that your app needs access to.

   This limits what your app can see in Workday, improving security and adhering to the principle of least privilege.

5. 5

   Copy the 'Client ID', 'Client Secret', 'Workday REST API Endpoint', 'Token Endpoint', and 'Authorization Endpoint' from Workday.

   These are the unique identifiers and addresses Lovable needs to establish the connection.

6. 6

   In Lovable, go to 'Connectors', select 'Workday', and choose 'Add connection' for an 'App user connector'.

   This starts the process of setting up the Workday connection within your Lovable workspace.

7. 7

   Give your Workday connection a name (e.g., 'Workday production') and paste all the copied details (Client ID, Secret, and the three endpoints) into the corresponding fields.

   This configures the connection in Lovable using the details from your Workday setup.

8. 8

   Decide who in your Lovable workspace can use this Workday connection (e.g., 'Only you', 'Invite specific people', or 'Invite entire workspace').

   This controls which builders in your team can use this Workday connection in their projects.

9. 9

   Click 'Create client' in Lovable.

   This finalizes the Workday connection setup in Lovable, making it ready for use in your projects.

10. 10

    Once the client is created, use a prompt in your Lovable project chat to tell Lovable what Workday data you want to display and how.

    This integrates the Workday connection into your app's user experience, allowing users to connect their accounts and see their data.

Let each signed-in user connect their own Workday account and show their time off balance on the dashboard.

API client

A special digital identity you create in Workday that allows other software (like your Lovable app) to securely access information from Workday on behalf of users.

Functional Areas

Specific categories of data or actions within Workday, like 'Staffing' for employee details or 'Time Off' for leave requests. When setting up an API client, you choose which areas your app is allowed to interact with.

Redirection URI

A specific web address that Workday sends a user's web browser to after they have successfully logged in and approved access for your app. It's a security measure to ensure the user is returned to the correct application.

Client ID

A public identifier for your API client, like a username, that Workday uses to recognize your app.

Client Secret

A confidential password for your API client that Workday uses to verify your app's identity. It must be kept secure.

Endpoints

Specific web addresses that your app uses to communicate with Workday's services, like where to send requests for data or where to get security tokens.

Authorization Code Grant

A secure method for an app to get permission to access a user's data without ever seeing their password. It involves Workday giving the app a temporary code, which the app then exchanges for an access token.

Bearer token

A type of security token that grants access to specific resources. If you have the token, you can use it, like a ticket to an event.

PKCE (Proof Key for Code Exchange)

An extra security measure for the 'Authorization Code Grant' flow, especially useful for apps that can't keep a client secret private. For this Workday connection, it needs to be turned off.

Non-Expiring Refresh Tokens

A setting that allows the connection between your app and Workday to stay active for a very long time, even if the user doesn't use the app for a while, preventing them from having to log in again frequently.

• Do not enable PKCE (Proof Key for Code Exchange) when registering the API client in Workday, as it prevents the connector from getting a client secret.
• Ensure the Redirection URI is copied exactly as provided; a typo will prevent the connection from working.
• Only select the necessary Functional Areas in Workday to limit data access and improve security.
• Keep the Client Secret secure and never share it publicly, as it functions like a password for your app's Workday access.
• Be aware that if a user revokes authorization in Workday, they will need to reconnect in your app.
• Understand that the connector cannot exceed the permissions set on the API client or the individual user's Workday permissions; a 403 error means access is denied by Workday.