ADP Workforce Now connector

Difficulty: 🔧ADVANCEDCustom Auth + Multi-Step Per-Consumer Setup
Authentication: OAuth 2.0OAuth 2.0 client credentials over mutual TLS, not a user-consent flow. ADP requires an X.509 client certificate on every call, plus Client ID and Secret.
Webhooks: Virtual webhooks↗ (Apideck polls for employee created, updated and terminated events)
Partnership Required: No(Not required. The add-on is bought per consumer, so it recurs on every connection. ADP's Marketplace Partner Program is a separate app-publishing route.)
Apideck Credentials: Not available(Not available: each consumer provisions their own ADP credentials and certificate.)
Costs: Consumer pays: ADP bills API Central monthly by employee count on their own ADP invoice. Prices are shown after signing in. No free trial, no Apideck fee.
Sandbox Availability: Not available(No self-service sandbox. A test instance exists only inside ADP's Marketplace Partner enrollment, which this connection model does not use.)
Account Type Required: ADP Workforce Now or Workforce Now Next Generation, ADP's US and Canada product, with ADP API Central purchased.
Consumer Access Level: An ADP administrator who can purchase the add-on, create a project, set Workforce Now permissions and generate a certificate.
Rate Limits: 120 requests/minute per API Central project and a maximum of 10 concurrent requests; ADP returns HTTP 429 beyond either limit.

Task	You (Customer)	Your Consumer	Apideck
Purchase ADP API Central	Share requirements	✓ (paid add-on)	—
Create project and select use case	—	✓	Documentation provided
Set Workforce Now permissions	—	✓	Documentation provided
Generate certificate and retrieve credentials	—	✓	Instructions provided
Enter credentials in Vault	Implement Vault	✓	—
Authorize connection	—	✓	Mints the OAuth token over mutual TLS
Renew certificate before expiry	Prompt the consumer	✓	—
Build via the Unified API	✓	—	Maintains the connector
Connection sync	—	—	✓ Polls via virtual webhooks
Monitor connections	✓ Via the Apideck Dashboard	Can revoke credentials or the certificate	Logs and alerts

Single environment: ADP Workforce Now uses one set of consumer-provisioned credentials: Client ID, Client Secret, client certificate and client key, all issued through the ADP API access add-on. There is no separate sandbox with its own credentials. To test, use an ADP Workforce Now account that has the add-on; ADP's developer portal also offers an API Explorer for browsing ADP's API catalogue without a connection. Apideck cannot supply temporary shared test credentials for this connector, because it has no Apideck-hosted sandbox app. Take care when testing against live payroll and HR data.

Credentials only exist once the consumer buys ADP API Central, which ADP publishes on its US storefront only. Workforce Now is ADP's US and Canada product; elsewhere use the ADP iHCM connector instead. Every consumer meets a purchase decision inside your onboarding flow.
The API Central project must explicitly include the Workers API. A project created with only the intuitive Employee Demographic Data use case returns 403 Invalid Scope on the worker list, so confirm the project covers it before treating the connection as broken.
The client certificate expires two years after issuance, and the connection stops working the moment it lapses. That is a dated, per-connection failure that lands long after the build is finished.
You cannot de-risk this build before a consumer commits: your first end-to-end test necessarily runs against that consumer's live Workforce Now tenant.

3 gotchas across 3 resources

Connector-specific behaviors and limitations to be aware of

2 supported resources

View field mappings, supported operations, and schema details