ADP Marketplace listing (optional, not required to use this connector)

You are on the Configuration Guide tab, and for this connector there is nothing for you to configure with ADP. Each of your consumers buys ADP's API-access add-on for their own ADP Workforce Now account, provisions their own credentials there, and enters them when they connect. You register nothing with ADP. If that is all you need, use the Connection Guide tab instead: it is the guide that matches the connector.

Read on if either of these applies to you:

You want to remove the per-consumer purchase step. On the API Central route every consumer buys the add-on themselves before they can connect, which puts a purchase decision inside your onboarding flow. Becoming an ADP Marketplace partner is the route that avoids that, and it is the reason most application owners end up on this page.
You want your own listing on ADP Marketplace, so that ADP clients can find and buy your integration there.

Either way, what follows is ADP's Marketplace Partner Program: its own application, agreement, review and portal.

Which route am I on?

	ADP API Central (what this connector uses)	ADP Marketplace Partner Program (this page)
Who provisions credentials	Each consumer, for their own ADP account	You, in the Partner Self-Service Portal
What you register with ADP	Nothing	Your company and your application
Agreement with ADP	None	Developer's Participation Agreement
Required to use the Apideck connector	Yes	No
Gets you a listing on ADP Marketplace	No	Yes, that is the point of it

One regional note, because it decides whether this route is relevant to your consumers at all: ADP Workforce Now is ADP's US and Canada product, and ADP publishes the API Central add-on for it on its US storefront only. Consumers outside the US and Canada are most likely on ADP iHCM, which Apideck supports through a separate connector.

1. Apply to the ADP Marketplace Partner Program

Apply at partners.adp.com/gettingstarted. The registration form runs in five steps:

Contact info: your name, email and phone
Terms agreement: ADP's partner expectations, including a mutual non-disclosure agreement and an undertaking to agree to the Developer's Participation Agreement
Company info: legal name, website, address
Sales info: your customer base, target markets, sales cycle and industry focus
Product info: your solution category, your technical capabilities, and the ADP API integration you plan to build

Two things are worth preparing before you open the form:

ADP asks you to identify mutual clients, so know which of your customers already run ADP.
ADP asks you to describe the integration concretely. Have your use case, the ADP data you need and the direction of the data flow written down.

ADP then reviews the application from a sales, security and legal angle before a Developer's Participation Agreement is issued. Acceptance is ADP's decision to make. Ask your ADP contact what your application still needs and what the next step is, rather than working to an assumed schedule.

2. Developer's Participation Agreement and your Technical Advisor

The Developer's Participation Agreement (DPA) is executed with ADP Business Development. It is the contract that governs your integration, your listing and the commercial terms attached to it.

ADP also assigns a Marketplace Technical Advisor. They are your named technical contact for the build, and they are the right person for every ADP-side question this page tells you to ask: API scope for your project, certificate handling, project setup, and what your listing needs before it can go live.

3. The Sandbox Stage and your test client sandbox

Partner onboarding includes a stage ADP calls the 30-day Sandbox Stage, during which you work in the Partner Self-Service Portal. That portal is also where you manage your partner members, your certificates and your projects.

To get a test instance, use Request A Test Instance on your DEV project. ADP responds with three emails:

the test-instance user ID and a link to it,
a temporary password,
a Connect Request that you have to approve yourself with Grant Consent.

For ADP Workforce Now and Workforce Now Next Generation, give the sandbox test user admin permission so that it can see all employees in the sandbox. Otherwise the data you read back looks incomplete for reasons that have nothing to do with your code.

The test client sandbox exists only inside the partner programme: it is requested, consented to and owned from within your own partner account. It is not part of the API Central route, so it is not a way to evaluate the Apideck connector before you have a real ADP tenant to test against.

4. DEV and PROD projects

The Partner Self-Service Portal separates DEV and PROD projects. You build and test against DEV with the test instance above; PROD is the project your listed application uses against real ADP client accounts. Members and certificates are managed per project in the portal, so ask your Technical Advisor which credentials carry over between the two before you plan a promotion path.

5. Certificates: the CSR flow

Every ADP Web API call needs an X.509 client certificate presented on the TLS connection in addition to an OAuth access token. That is ADP's requirement, not an optional hardening step, and it applies on both routes. What differs is where the certificate comes from: the steps below are the partner-portal CSR flow for a certificate on your own partner project, whereas on the API Central route each consumer obtains their own certificate through the API Central portal's Manage Certificate flow, covered in the Connection Guide tab.

You obtain the certificate for your partner project through a certificate signing request (CSR):

Generate a private key and a CSR. ADP's article walks through it, including the OpenSSL commands: Generate a Certificate Signing Request.
Submit the CSR from the portal's Certificate tab, using Request Certificate, then copy your private key and download the signed certificate that ADP returns.
Keep the private key. ADP signs and returns the certificate; the key half never leaves your side, and a certificate without its key is unusable.

ADP's web-services certificate authority is Sectigo, which is worth knowing if your security team vets certificate issuers.

Background on the programme as a whole, including the partner stages and listing types, is in ADP's own Marketplace Partner Development Learning Guide (PDF).

Renewal: two years, by new CSR

A signed certificate is valid for two years from the date it was created, and it is renewed by submitting a new CSR, not by extending the existing certificate. ADP emails the person who created the certificate, plus the other users on the project, as the expiry date approaches, so point those notices at a monitored mailbox rather than one individual's inbox. When a certificate lapses, the calls that depend on it stop working.

6. What a Connector listing costs

ADP publishes no partner fee. There is no published listing fee, annual fee, certification fee or security-review fee anywhere in ADP's partner documentation. Where ADP does address partner-side cost for API access it states zero: a heading in its own developer material reads "New API Scopes - No Additional Fees".

What ADP does publish is that a revenue share exists, and it never states the percentage. ADP acts as the billing and collection agent, collecting subscription payments from clients and remitting your share net of its own: "ADP remits partner's revenue share after excluding ADP revenue share", with a typical remittance window of 60 to 90 days. The partner portal likewise offers to "track revenue-share payments to ADP".

So the commercial terms are negotiated individually with the ADP Business Development resource assigned to you and recorded in the Developer's Participation Agreement, which ADP does not publish. Treat any figure you find elsewhere as unofficial: third-party numbers do circulate, they are not ADP-published, and at least one has already changed since it was posted. Ask your Business Development contact for the terms that apply to you.

One structural point worth knowing before you negotiate: in ADP's own vocabulary a "marketplace" is a storefront, not a product family. ADP's partner project form carries a field labelled "Marketplace: USA or CAN", and ADP runs separate storefronts for the US, Canada and international. A single listing can cover more than one ADP platform, but the international storefront requires a separate ADP Marketplace international partner agreement, which applies to existing North American partners too.

This is separate from the API-access add-on your consumers buy for their own ADP account, which appears on the consumer's own ADP invoice. See the connector's Overview tab for that side of the costs.

7. How a listing relates to the Apideck connector

Nothing about the Apideck connector changes if you become an ADP Marketplace partner. Concretely:

The connector authenticates with ADP's client-credentials grant over mutual TLS, and takes four values per connection: Client ID, Client Secret, Client Certificate (the entire contents of the .crt, including the BEGIN and END lines) and Client Key (the entire contents of the .key, including the BEGIN and END lines).
Those four values belong to the connection, not to your integration. There is no application-level client credential for you to paste in for this connector. You enable and monitor the connector from the Apideck ADP Workforce Now connector settings in the Apideck Dashboard.
There is no browser redirect anywhere in this connector's authentication: no consumer is ever sent through an ADP consent screen by Apideck. So do not register Apideck's Vault callback URL (https://unify.apideck.com/vault/callback) on an ADP application of your own: it plays no part here.
A listing is not what unlocks endpoints. ADP sells client-side API Central use-case templates that already cover employee demographics, paid time off, time and attendance and payroll input, and it publishes a case study of an ordinary ADP client reading employee and time and attendance data through API Central with no listing at all. Where ADP does gate Time APIs, the stated requirement is that the client's ADP account has the Time and Attendance module enabled, not that you are a partner. The one partner-only API family found in ADP's published material is the Payroll Output (Turbo) API, which covers payroll results rather than the pay data written into ADP.
If you get a listing and want to know whether credentials issued inside your own partner project can be used in those four fields, ask your Marketplace Technical Advisor. ADP decides what its partner projects issue and how those credentials are scoped. The four labels above are what the Apideck connector expects, whatever their origin.

FAQ and troubleshooting

Do I need a Marketplace listing before my consumers can connect? No. A consumer connects with credentials from their own ADP account's API-access add-on. The Connection Guide tab is the whole procedure.

Can one set of credentials serve all my consumers? On the API Central route, no: the credentials belong to each ADP client's own account, so every connection in Vault carries its own four values. If you are on the partner route, ask your Technical Advisor how credentials work for a listed application: that is ADP's design to explain.

A certificate is expiring, or a working connection suddenly fails to authenticate. Check the certificate's age first: an ADP certificate expires two years after it was created, and a lapsed certificate breaks whatever depends on it. A certificate you generated for your own partner project is renewed in the Partner Self-Service Portal by submitting a new CSR (see Section 5). For a connector connection, the certificate and key are per-connection values the consumer holds in their own ADP account, so replacing an expiring one is the consumer's action, and the procedure is in the Connection Guide tab.

Where do I chase my partner application, DPA or sandbox request? With ADP: your ADP Business Development contact for the application and the DPA, your Marketplace Technical Advisor for the portal, projects, certificates and the test instance. Those are ADP's to answer.

Something on the Apideck side is not behaving. Contact Apideck Support.