How to connect to SD Worx BE SME OpenPayroll

This guide walks you through connecting your SD Worx BE SME payroll file so the integration can read your employer and employee information.

Note: SD Worx BE SME OpenPayroll does not use a login screen. Access is granted by SD Worx BeIntegration to a certificate you register with them, and you enter the resulting Client ID and the certificate's private key in the connection form below.

What you need

An active SD Worx BE SME payroll file (employer) in Belgium.
A Client ID issued by SD Worx BeIntegration for a certificate you registered (see step 1). If your accountant or software partner manages the SD Worx integration for you, they may already have these.
The private key of that certificate, as PEM text without a passphrase.

1. Register a certificate with SD Worx BeIntegration

SD Worx requires a self-signed certificate (signature algorithm SHA256withRSA, TLS 1.2 or higher). Generate one and keep the private key in a secure place.

Email the public certificate only (the .crt file, never the private key) to SD Worx BeIntegration at beintegration@sdworx.com, mentioning the SD Worx BE SME OpenPayroll API and the payroll file (employer) it should have access to. SD Worx registers the certificate, links your payroll file to it and sends you a Client ID. Ask your SD Worx contact for a timeline; there is no self-service portal for this step.

Apideck signs the login request with the private key directly, so it must not be passphrase protected. Export an unencrypted copy, for example:

openssl pkey -in sdworx.key -out sdworx-unencrypted.pem

Keep the passphrase-protected original as your backup.

2. Fill in the connection form

When you open the connection, enter:

Field	Description
Client ID	The Client ID SD Worx BeIntegration issued for your registered certificate.
Private key	The certificate's private key as PEM text, including the `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` lines, without a passphrase.

Check the first line before you paste. A key that starts with -----BEGIN ENCRYPTED PRIVATE KEY----- is passphrase protected and is the most common reason the connection fails to authorize. Convert it with the openssl pkey command from step 1 and paste the copy that starts with -----BEGIN PRIVATE KEY-----. Do not paste the certificate (-----BEGIN CERTIFICATE-----) either: SD Worx has that, Apideck needs the key.

Click Save. Apideck signs in to SD Worx with these details and the connection shows as connected.

3. Select your employer

Open the connection again. The Employer dropdown now lists the payroll files SD Worx has linked to your Client ID. Select the employer whose data this connection should expose and click Save.

Field	Description
Employer	The SD Worx employer (payroll file) whose employees this connection exposes.

If you manage several payroll files, set up one connection per employer.

FAQ and troubleshooting

Do I need to log in to SD Worx?

No. There is no SD Worx login screen. The certificate you registered with SD Worx BeIntegration is what grants access; you only enter the Client ID and private key once.

The dropdown only shows payroll files SD Worx has linked to your Client ID. Ask SD Worx BeIntegration to link your payroll file; they may ask you to confirm the access from your side. Also check that the Client ID and private key were saved without errors.

The connection shows an error after saving

Look at the first line of what you pasted: -----BEGIN ENCRYPTED PRIVATE KEY----- means the key is still passphrase protected, and -----BEGIN CERTIFICATE----- means you pasted the certificate instead of the key. Only a key starting with -----BEGIN PRIVATE KEY----- works. Also check that it belongs to the certificate you registered and was pasted in full. Acceptance and production credentials are separate: a Client ID issued for the acceptance environment does not work against production.

My certificate is about to expire

Generate a new certificate and send the public part to SD Worx BeIntegration at least 6 weeks before expiry, then paste the new private key into the connection. There is no in-product reminder, so track the expiry date yourself.

Can I see terminated employees?

Mostly no: once SD Worx removes a contract from its active-contracts list, it stops appearing here and is not returned. Until then, a contract can still show up with employment_status: terminated for a period after its leaving date has passed, so do not assume this status value never appears.

Can I get time off or absence data?

Not through this connection. SD Worx keeps absences in its separate HR Selfservice product, which uses its own credentials and is not part of this connector.

If your employer is listed and connected but the data still looks wrong, contact Apideck Support.