> ## Documentation Index > Fetch the complete documentation index at: https://docs.pinkfish.ai/llms.txt > Use this file to discover all available pages before exploring further. # Connect Workday with an Integration System User > Give Pinkfish access to Workday through a service account, with no user login Pinkfish can connect to Workday as an **Integration System User (ISU)**, Workday's name for a service account. Nobody signs in to Workday: Pinkfish proves its identity with a private key, using the OAuth 2.0 **JWT Bearer** grant. Use this when agents and workflows should reach Workday on behalf of your organization rather than one person. The connection works with the Workday REST APIs and with every Workday MCP server (`workday-common`, `workday-absence-management`, and the others). ## What you need A Workday administrator does the Workday steps. You will collect five values for Pinkfish: | Value | Where it comes from | | - | - | | Workday hostname | The host of your tenant's **Workday REST API Endpoint**, for example `wd2-impl-services1.workday.com` | | Tenant | Your tenant name, for example `acme_dev` | | Client ID | The API client you register below | | Integration System User | The ISU username, for example `ISU_Pinkfish` | | Private key | The PEM private key whose certificate you upload to Workday | ## Step 1: Create a key pair Create an RSA private key and a self-signed x509 certificate. Keep the private key safe; it is what lets Pinkfish act as the ISU. ```bash theme={null} openssl req -x509 -newkey rsa:2048 -nodes -days 730 \ -keyout pinkfish-workday.key -out pinkfish-workday.crt \ -subj "/CN=pinkfish-workday" ``` `pinkfish-workday.crt` goes to Workday. `pinkfish-workday.key` goes to Pinkfish. The key must be RSA and unencrypted (no passphrase). ## Step 2: Set up the Integration System User in Workday 1. Create an Integration System User, or pick an existing one. 2. Add it to an **integration system security group**. 3. Give that group access to the security domains your agents need, for example Worker Data for staffing tools. Then run **Activate Pending Security Policy Changes**. The ISU can only read and change what its security group allows. If a Workday call returns `permission denied` (code `S22`), the ISU's group is missing access to that data. ## Step 3: Register the API client in Workday Run the Workday task **Register API Client** and fill it in: * **Client Grant Type:** Jwt Bearer Grant * **x509 Certificate:** upload `pinkfish-workday.crt` * **Integration System User:** the ISU from Step 2 * **OAuth 2.0 Audience:** leave the default, `workday` * **Scope (Functional Areas):** the areas your agents need Save, then open **View API Clients** and find the new client. Copy its **Client ID**. The **Workday REST API Endpoint** on that page has the form `https:///ccx/api/v1/`; the hostname and tenant come from it. ## Step 4: Create the connection in Pinkfish 1. Go to **Tools → Connections** and click **Add Connection**. 2. Search for **Workday**, select it, and click **Continue**. 3. Under **Authentication method**, choose **Using an Integration System User (no user login)**. 4. Enter the hostname (host only, no `https://` or path), tenant, client ID and ISU username. 5. Upload or paste the private key. 6. Leave **OAuth 2.0 Audience** empty unless you changed it on the API client. 7. Click **Create**. Pinkfish checks the connection by requesting a token from Workday. It does not read any Workday data during this check, so it works for an ISU with narrow access. The connection appears in the list as `@`. ## Using the connection Agents, workflows and the Workday MCP servers use the connection like any other Workday connection. Pinkfish requests a new access token from Workday when the old one expires. Only people who can edit a connection can retrieve its raw access token. People it is shared with read-only can still use it through Pinkfish. See [Sharing and identity](https://docs.pinkfish.ai/tools/sharing-and-identity.md). ## Troubleshooting | Message | What to check | | - | - | | `Invalid Workday hostname` | Enter only the host, ending in `workday.com` or `myworkday.com`. | | `private_key is not a valid PEM private key` | Paste the whole key, including the `BEGIN` and `END` lines. Passphrase-protected keys are not supported. | | `Workday JWT Bearer token request failed (400)` or `(401)` | The client ID, ISU, or certificate does not match. Check that the API client uses the Jwt Bearer grant, names this ISU, and has the certificate that matches your private key. | | `permission denied` (`S22`) from a Workday call | Sign-in worked, but the ISU's security group has no access to that data. Add the domain in Workday and activate the security policy changes. | To stop Pinkfish from using the ISU, disconnect or delete the connection in Pinkfish. To cut access completely, also disable the API client in Workday. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.