Skip to main content
Beta. This is a deploy-only connector: Runlayer hosts the MCP server, and it authenticates to your Workday tenant using an OAuth 2.0 API client that your Workday administrator registers.
Connect your AI assistant to Workday for HR workflows across workers, time off, time tracking, and business process approvals. The connector uses the Authorization Code Grant with PKCE, so each user authorizes with their own Workday identity and calls run with their own permissions.

​
Tools and required scopes

Each tool calls a specific Workday REST API service. On your API client, enable the Scope (Functional Area) that secures the services for the tools you plan to use.
Functional-area names can vary slightly by Workday version. The authoritative requirement for any operation is the Secured by section of that API in your tenant’s Workday REST API reference. The table maps each tool group to the API service it calls (which is fixed) and the functional area that typically secures it.
Some services read data secured by more than one functional area (for example organization data under common). If a tool returns a permission error after connecting, check that API’s Secured by requirements and add the missing functional area or security-group access.

​
Setup

Task names and screens vary by Workday version. Your Workday administrator should follow the tenant’s own documentation for Register API Client for Integrations and the View API Clients report. The steps below describe what Runlayer needs.
1

Register an OAuth 2.0 API client in Workday

Have your Workday administrator confirm the tenant has OAuth 2.0 Clients Enabled, then register an API client configured for the Authorization Code Grant. The connector authenticates as a public client using PKCE, so no client secret is required.Under Scope (Functional Areas), select the areas for the tools you plan to use (see the table above).
2

Enable refresh tokens

Confirm the API client is configured to issue refresh tokens. Without one, Runlayer cannot renew access silently and users must re-authenticate each time the access token expires. Refresh-token behavior is set on the API client; use your tenant’s Workday documentation to confirm the correct settings for an interactive Authorization Code client.
3

Register the Runlayer callback URL and allowed origin

Workday’s token endpoint requires an allowed origin for public clients that use PKCE. On the API client, add Runlayer’s OAuth callback URL as both an allowed redirect URI and an Allowed Origin (sometimes labeled CORS), exactly and with no trailing slash:
Runlayer sends this full callback URL in the Origin header during the initial token exchange and token refresh. Enter the full URL, including /oauth/callback, in both Workday settings.
4

Collect the API client values

From the View API Clients report, record: Client ID, Authorization Endpoint, Token Endpoint, and Workday REST API Endpoint.
5

Add the connector in Runlayer

In Runlayer, go to My connectors, find Workday, and click Add connector. Enter the values from the previous step (see Configuration Reference), then click Deploy Server.
6

Authorize

  1. On the server page, click Connect under Missing Authorization
  2. Complete the Workday login and consent flow
Each user connects with their own Workday credentials, so tools run with that user’s permissions.

​
Configuration Reference

Required: The redirect URI is set automatically to your Runlayer callback URL and does not need to be entered.
The authorization, token, and REST API hosts are not always the same (common on implementation/sandbox tenants). Use the exact endpoint values from the View API Clients report rather than assuming they share a host.

​
Troubleshooting

Check WORKDAY_BASE_URL. It must be the host only (scheme + host, no path), not the full REST API Endpoint that includes /ccx/api/v1/<tenant>. Including the path causes it to be duplicated and the request to 404.
This usually means the API client is not issuing a refresh token. Ask your Workday administrator to confirm refresh tokens are enabled for the client (see Setup, Step 2). Runlayer stores and uses whatever the token endpoint returns; if no refresh token is issued, sessions cannot be renewed silently.
Verify the Runlayer callback URL is registered on the API client as both an allowed redirect URI and an Allowed Origin (sometimes labeled CORS). Both values must be the full callback URL, matching exactly with no trailing slash: https://<your-tenant>.runlayer.com/oauth/callback.
Confirm the Scope (Functional Areas) on the API client cover that tool’s API service (see the table above), and that the connecting user’s Workday security groups grant access to the underlying data.

​
Updating configuration

After deployment, you can update configuration via the CLI: