How to set up the SD Worx BE SME OpenPayroll connector in Apideck

Apideck enables you to build a native integration with SD Worx BE SME OpenPayroll, the payroll master data API for Belgian SME customers of SD Worx (employers, active contracts and person details). This guide explains what you, as the application owner, configure for the SD Worx BE SME OpenPayroll connector.

Note: This connector authenticates with OAuth 2.0 client credentials using a certificate-backed private_key_jwt client assertion (RS256). SD Worx BeIntegration registers a certificate per customer and issues a Client ID for it, so the credentials belong to the connecting employer, not to your application. Your consumers enter their own Client ID and private key in the connection form. You do not register anything with SD Worx and there are no application-level credentials to enter.

Prerequisites

An Apideck application with the HRIS Unified API enabled.
Consumers who have, or can obtain, a registered certificate and Client ID from SD Worx BeIntegration. The consumer connection guide walks them through that; you can point them to it or to their SD Worx contact. The API itself is documented on the SD Worx developer portal, which needs an account SD Worx provisions.

1. Enable the connector

Go to Apideck Dashboard → Configuration → HRIS → SD Worx BE SME OpenPayroll and enable the connector. There is no Credentials section to fill in.

2. Choose the environment

SD Worx BE SME OpenPayroll exposes two environments, each with its own API host and OAuth token host:

Environment	API host	Token host
Production	`https://api.sdworx.com/opensmepayroll-one`	`https://auth.sdworx.com/idhub/oidc/v1/token`
Staging (acceptance)	`https://api.acc.sdworx.com/opensmepayroll-one`	`https://auth.acc.sdworx.com/idhub/oidc/v1/token`

Under Servers, select the Server URL for the environment your consumers' Client IDs were issued for; Apideck uses the matching token host automatically. A Client ID issued for acceptance does not work against production, so the environment applies to every connection of this integration. Use Staging (acceptance) with a test Client ID to validate your integration, then switch to Production.

Press Save settings.

3. What your consumers do

Each consumer (employer) registers a self-signed certificate with SD Worx BeIntegration (beintegration@sdworx.com), receives a Client ID, and enters the Client ID and the certificate's private key (PEM, without passphrase) in the Apideck connection form. Once saved, they pick their employer (payroll file) from a dropdown. The private key is stored encrypted and is only used to sign the login assertion.

Scope

The connector requests the beintegration-opensme-api scope. This is fixed by SD Worx for this API and is not user-configurable.

FAQ and troubleshooting

Why is there no Client ID or secret on this page?

SD Worx issues the Client ID to the party that registered the certificate, and BeIntegration links payroll files to that Client ID. Keeping the credentials on the connection means each consumer only ever sees its own payroll files.

The dropdown lists the payroll files SD Worx has linked to the consumer's Client ID. The consumer should ask SD Worx BeIntegration to link their payroll file; SD Worx may ask them to confirm the access.

A consumer cannot authorize

Almost always the pasted key: it must start with -----BEGIN PRIVATE KEY-----. A key starting with -----BEGIN ENCRYPTED PRIVATE KEY----- is still passphrase protected, and -----BEGIN CERTIFICATE----- is the certificate, not the key. The consumer guide has the conversion command.

A consumer's connection stopped working

Their certificate may have expired. SD Worx must be told at least 6 weeks before a certificate expires; the consumer registers the renewed certificate the same way and pastes the new private key into the connection. If the certificate is still valid, contact Apideck Support.