Skip to main content
Pinkfish can connect to Workday as an Integration System User (ISU), Workday’s name for a service account. Nobody signs in to Workday: Pinkfish proves its identity with a private key, using the OAuth 2.0 JWT Bearer grant. Use this when agents and workflows should reach Workday on behalf of your organization rather than one person. The connection works with the Workday REST APIs and with every Workday MCP server (workday-common, workday-absence-management, and the others).

​
What you need

A Workday administrator does the Workday steps. You will collect five values for Pinkfish:

​
Step 1: Create a key pair

Create an RSA private key and a self-signed x509 certificate. Keep the private key safe; it is what lets Pinkfish act as the ISU.
pinkfish-workday.crt goes to Workday. pinkfish-workday.key goes to Pinkfish. The key must be RSA and unencrypted (no passphrase).

​
Step 2: Set up the Integration System User in Workday

  1. Create an Integration System User, or pick an existing one.
  2. Add it to an integration system security group.
  3. Give that group access to the security domains your agents need, for example Worker Data for staffing tools. Then run Activate Pending Security Policy Changes.
The ISU can only read and change what its security group allows. If a Workday call returns permission denied (code S22), the ISU’s group is missing access to that data.

​
Step 3: Register the API client in Workday

Run the Workday task Register API Client and fill it in:
  • Client Grant Type: Jwt Bearer Grant
  • x509 Certificate: upload pinkfish-workday.crt
  • Integration System User: the ISU from Step 2
  • OAuth 2.0 Audience: leave the default, workday
  • Scope (Functional Areas): the areas your agents need
Save, then open View API Clients and find the new client. Copy its Client ID. The Workday REST API Endpoint on that page has the form https://<hostname>/ccx/api/v1/<tenant>; the hostname and tenant come from it.

​
Step 4: Create the connection in Pinkfish

  1. Go to Tools → Connections and click Add Connection.
  2. Search for Workday, select it, and click Continue.
  3. Under Authentication method, choose Using an Integration System User (no user login).
  4. Enter the hostname (host only, no https:// or path), tenant, client ID and ISU username.
  5. Upload or paste the private key.
  6. Leave OAuth 2.0 Audience empty unless you changed it on the API client.
  7. Click Create.
Pinkfish checks the connection by requesting a token from Workday. It does not read any Workday data during this check, so it works for an ISU with narrow access. The connection appears in the list as <isu>@<tenant>.

​
Using the connection

Agents, workflows and the Workday MCP servers use the connection like any other Workday connection. Pinkfish requests a new access token from Workday when the old one expires. Only people who can edit a connection can retrieve its raw access token. People it is shared with read-only can still use it through Pinkfish. See Sharing and identity.

​
Troubleshooting

To stop Pinkfish from using the ISU, disconnect or delete the connection in Pinkfish. To cut access completely, also disable the API client in Workday.