> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Paylocity Weblink connector

> ConductorOne provides identity governance for Paylocity Weblink. Integrate your Paylocity Weblink instance with ConductorOne to run user access reviews (UARs) and sync employee data.

<Tip>
  **Paylocity has two separate API systems.** This connector uses the **Weblink (legacy) API v2**, which does not return sensitive PII fields (SSN, DOB, ethnicity). There is a separate [Paylocity connector](/baton/paylocity) that uses the NextGen API.

  Use this connector if you need to avoid transmitting sensitive PII data to ConductorOne.
</Tip>

## Capabilities

The Paylocity Weblink connector syncs the following resources:

| Resource | Sync                                                          | Provision |
| :------- | :------------------------------------------------------------ | :-------- |
| Accounts | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | Disable   |

## Gather Paylocity Weblink credentials

Configuring the connector requires you to pass in credentials generated in Paylocity. Gather these credentials before you move on.

<Warning>
  A Paylocity administrator with access to the **Web Pay** portal's Web Services settings must perform this task.
</Warning>

<Steps>
  <Step>
    Sign in to the Paylocity Web Pay portal and navigate to **Company** > **Setup** > **Integrations** > **Web Services**.
  </Step>

  <Step>
    Create or locate an API client with the **WebLinkAPI** scope:

    1. If you don't already have Weblink API credentials, contact Paylocity support to request Weblink API access for your company
    2. Once enabled, create a new API client or use an existing one
    3. Ensure the client has the `WebLinkAPI` scope
  </Step>

  <Step>
    Copy and save the following values:

    * **Client ID**: The OAuth2 client ID
    * **Client Secret**: The OAuth2 client secret
    * **Company ID**: Your full Paylocity company ID **including the suffix** (e.g., `347766RCU`). Using only the numeric prefix will cause 403 errors.
    * **API Gateway URL**: The Weblink API gateway URL for your environment:
      * Sandbox: `https://dc1demogw.paylocity.com`
      * Production: `https://api.paylocity.com`
  </Step>
</Steps>

<Warning>
  The **Company ID** must include the full alphanumeric value with its suffix (e.g., `347766RCU`). The numeric-only prefix (`347766`) will authenticate successfully but return 403 errors on all data endpoints.
</Warning>

## Configure the Paylocity Weblink connector

<Warning>
  To complete this task, you'll need:

  * The **Connector Administrator** or **Super Administrator** role in ConductorOne
  * Access to the set of Paylocity Weblink credentials generated by following the instructions above
</Warning>

<Tabs>
  <Tab title="Cloud-hosted">
    **Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.**

    <Steps>
      <Step>
        In ConductorOne, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Paylocity Weblink** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Paylocity Weblink connector:

        * Add the connector to a currently unmanaged app
        * Add the connector to a managed app
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the required configuration:

        * **Client ID** (required): Your Paylocity Weblink OAuth2 client ID
        * **Client Secret** (required): Your Paylocity Weblink OAuth2 client secret
        * **Company ID** (required): Your full Paylocity company ID with suffix (e.g., `347766RCU`)
        * **API Gateway URL**: Defaults to production (`https://api.paylocity.com`). Override only for sandbox/testing (e.g., `https://dc1demogw.paylocity.com`).
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Paylocity Weblink connector is now pulling access data into ConductorOne.
  </Tab>

  <Tab title="Self-hosted">
    **Follow these instructions to use the [Paylocity Weblink](https://github.com/ConductorOne/baton-paylocity-weblink) connector, hosted and run in your own environment.**

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals.

    ### Resources

    * [Official download center](https://dist.conductorone.com/ConductorOne/baton-paylocity-weblink): For stable binaries (Windows/Linux/macOS) and container images.

    * [GitHub repository](https://github.com/ConductorOne/baton-paylocity-weblink): Access the source code, report issues, or contribute to the project.

    ### Step 1: Set up a new Paylocity Weblink connector

    <Steps>
      <Step>
        In ConductorOne, navigate to **Integrations** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Paylocity Weblink connector:

        * Add the connector to a currently unmanaged app
        * Add the connector to a managed app
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        In the **Settings** area of the page, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new Client ID and Secret.

        Carefully copy and save these credentials. We'll use them in Step 2.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your Paylocity Weblink connector deployment:

    #### Secrets configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-paylocity-weblink-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-paylocity-weblink-secrets
    type: Opaque
    stringData:
      # ConductorOne credentials
      BATON_CLIENT_ID: <ConductorOne client ID>
      BATON_CLIENT_SECRET: <ConductorOne client secret>

      # Paylocity Weblink credentials
      BATON_PAYLOCITY_CLIENT_ID: <Paylocity OAuth2 client ID>
      BATON_PAYLOCITY_CLIENT_SECRET: <Paylocity OAuth2 client secret>
      BATON_PAYLOCITY_COMPANY_ID: <Paylocity company ID with suffix, e.g. 347766RCU>
      BATON_PAYLOCITY_BASE_URL: <Weblink API gateway URL, e.g. https://api.paylocity.com>
    ```

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-paylocity-weblink.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-paylocity-weblink
      labels:
        app: baton-paylocity-weblink
    spec:
      selector:
        matchLabels:
          app: baton-paylocity-weblink
      template:
        metadata:
          labels:
            app: baton-paylocity-weblink
            baton: "true"
            baton-app: paylocity-weblink
        spec:
          containers:
          - name: baton-paylocity-weblink
            image: public.ecr.aws/conductorone/baton-paylocity-weblink:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-paylocity-weblink
            envFrom:
            - secretRef:
                name: baton-paylocity-weblink-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In ConductorOne, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Paylocity Weblink connector to. Paylocity Weblink data should be found on the **Entitlements** and **Accounts** tabs.
      </Step>
    </Steps>

    **Done.** Your Paylocity Weblink connector is now pulling access data into ConductorOne.
  </Tab>
</Tabs>

***

<Tip>
  All versions of this connector are available at [dist.conductorone.com](https://dist.conductorone.com/ConductorOne/baton-paylocity-weblink).
</Tip>