Confidential clients

Joe Julian Updated by Joe Julian

Creating a confidential client in Advanced HR

For a 3rd party application to use the Advanced HR APIs they will need a confidential client account. This adds a layer of security and allows you to manage the data that the 3rd party application can access.

Getting permission to manage API clients

In order to create confidential clients you must be logged in as a user with SSO Administrator privileges. To get these privileges you will need to find the relevant user account in MyWorkplace and enable the Customer administrator checkbox.

Please check out the user roles guide for MyWorkplace if you require more detailed instructions on setting up a Customer administrator.

Managing API clients in Advanced HR

Once you have the SSO Administrator privilege, you will see a new menu item in the Admin menu of Advanced HR, titled Security Manager.

In the Manage clients screen you can view, create and delete confidential clients. You can’t modify the client details (except for changing the associated Advanced HR security group).

If client credentials become compromised please delete them, and create a new client.

The Create Client screen

These screens are only editable during the initial creation of the client. If amendments are required following creation, please delete the user and re-create from new.

Client name

This is only used in Advanced HR for identifying specific API clients.

Client Id

This is the Id that will be passed to the 3rd party administrator and represents the equivalent of the ‘user name’ for an application. For example, we suggest ‘payrollapiclient’ for a payroll API client.

What makes a valid client name and Id?
🔡 lower case letters only
⛔ no spaces
⛔ no special characters
✅ can include hyphens (-)
Secret

This value will also be passed to the 3rd party administrator, and represents the ‘password’ for an application. Use the Save button to save the confidential client, and you will see that the Secret value is automatically generated.

We have provided Copy buttons for the Client Id and Secret, to make it easier to retrieve and send them to the 3rd parties.
User Group

The user group to add the confidential client to. This will determine the data permissions that the 3rd party subscriber will get when connected to Advanced HR

For Payroll API confidential clients, create or choose a user group that has no permissions to any Advanced HR tables or columns. The Payroll API does not use custom tables.

Using Confidential Client credentials

Once you’ve generated credentials for a confidential client, you can use the Copy buttons to read and paste them into a secure mechanism for distributing to a 3rd party subscriber.

For security, please ensure you send the Client Id and Secret values separately.

Was this article useful?

APIs for integration

Contact