> For the complete documentation index, see [llms.txt](https://integrations.drivetrain.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://integrations.drivetrain.ai/integration-guide/readme/hris-and-ats/integrating-with-paycor.md).

# Integrating with Paycor

How to provision API access in Paycor and share credentials with the Drivetrain engineering team.

[Prerequisites](#prerequisites)

[Paycor Setup](#paycor-setup)\
[Step 1: Register for the Paycor Developer Portal](#step-1-register-for-the-paycor-developer-portal)\
[Step 2: Create a New Application](#step-2-create-a-new-application)\
[Step 3: Configure Data Access (Scopes)](#step-3-configure-data-access-scopes)\
[Step 4: Configure Security Connections](#step-4-configure-security-connections)\
[Step 5: Activate the Application Against Your Production Tenant](#step-5-activate-the-application-against-your-production-tenant)

[Share Credentials with the Drivetrain Team](#share-credentials-with-the-drivetrain-team)

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

To connect Paycor to Drivetrain, you need:

* Paycor administrator access. You must hold a Company Admin, HR Admin, or Payroll Admin role in Paycor. Without this role, the production activation step fails with a 403 error.
* An active Paycor subscription for the modules whose data you want to share (for example: Core HR, Payroll, Time).
* Access to the Paycor Developer Portal at developers.paycor.com. If you haven't used the portal before, you register as part of Step 1 below.
* A secure channel to share credentials with the Drivetrain team. The Drivetrain team provides a secure intake link. Do not send credentials over plain email or Slack.

### Paycor Setup <a href="#paycor-setup" id="paycor-setup"></a>

Complete the following steps in the Paycor Developer Portal to create and configure an OAuth application that Drivetrain uses to access your data. Once done, you have four credentials to share with the Drivetrain team: Client ID, Client Secret, Subscription Key, and Legal Entity ID.

#### Step 1: Register for the Paycor Developer Portal <a href="#step-1-register-for-the-paycor-developer-portal" id="step-1-register-for-the-paycor-developer-portal"></a>

1. Go to [developers.paycor.com/join-developer-portal](https://developers.paycor.com/join-developer-portal).
2. Under "Are you an existing Paycor client?" click **Get started**.
3. Sign in with your Paycor username and password.
4. Select the client(s) you want to be able to activate apps for.
5. Choose an administrator for the Developer Portal account (typically yourself) and click **Request Access**.
6. Sign out and sign back in. This step is required for your new permissions to take effect.

{% hint style="info" %}
If you don't see the Applications tab after signing back in, your access request is still pending. Wait a few minutes and refresh, or contact your internal Paycor administrator.
{% endhint %}

#### Step 2: Create a New Application <a href="#step-2-create-a-new-application" id="step-2-create-a-new-application"></a>

1. From the Developer Portal home screen, click **Applications**.
2. Click the **+ Application** button.
3. Enter an application name (recommended: YourCompany – Drivetrain Tap) and select **Standard Application** as the type.
4. Click **Create Application**.
5. Immediately copy the Client ID and Client Secret shown in the confirmation pop-up. The Client Secret is shown only once — if you miss it, you need to regenerate it from the Security Connections tab.
6. Click **Got it** to dismiss the dialog.

{% hint style="warning" %}
Save your Client Secret now. Paycor does not display it again after this dialog closes. Paste both the Client ID and Client Secret into a secure password manager before continuing. If lost, the secret can be regenerated, but the previous value stops working immediately.
{% endhint %}

#### Step 3: Configure Data Access (Scopes) <a href="#step-3-configure-data-access-scopes" id="step-3-configure-data-access-scopes"></a>

Scopes control which Paycor objects the integration can read. Configure these on the **Data Access** tab of your application.

1. Open your application and click the **Data Access** tab.
2. Click **+ Scope** and give it a descriptive name, for example: `native-tap-read`.
3. Select the permissions listed in the Required Scopes table below. Apply read-only permissions wherever possible.
4. Click **Save**.
5. Switch to the **General** tab and copy the Scope name that now appears. You need it in Step 5.

**Required Scopes**

Enable the following data permissions. If a permission is not listed in your Paycor instance, you don't subscribe to that module — skip it.

| Object / Domain            | Permission | Why we need it                                                          |
| -------------------------- | ---------- | ----------------------------------------------------------------------- |
| Employees                  | Read       | Core employee records (name, status, hire date, work location, manager) |
| Person / Demographics      | Read       | Contact info, addresses, phone numbers, emergency contacts              |
| Employments / Jobs         | Read       | Job title, FLSA status, employment type, manager hierarchy              |
| Pay Rates                  | Read       | Current and historical pay rate information                             |
| Earnings                   | Read       | Earnings history per pay period                                         |
| Deductions                 | Read       | Pre- and post-tax deductions                                            |
| Taxes                      | Read       | Federal, state, and local tax records                                   |
| Direct Deposits            | Read       | Bank account routing information for verification only                  |
| Departments / Cost Centers | Read       | Organizational structure and reporting hierarchy                        |
| Legal Entities             | Read       | Required for any company-scoped API call                                |
| Time Off Requests          | Read       | PTO balances and time-off events (if Time module enabled)               |
| Time Card Punches          | Read       | Worked-hours data (if Perform Time module enabled)                      |

#### Step 4: Configure Security Connections <a href="#step-4-configure-security-connections" id="step-4-configure-security-connections"></a>

1. Open the **Security Connections** tab on your application.
2. Copy the APIm Subscription Key. This is the value sent in the `Ocp-Apim-Subscription-Key` header on every API call. Save it alongside your Client ID and Client Secret.
3. In the **Approved Return OAuth URL** field, paste this redirect URI: `https://id.drivetrain.ai/auth/callback`
4. Save your changes.

{% hint style="danger" %}
The redirect URI must be an exact match. Paycor checks it character by character.

A trailing slash, mixed casing, or an http vs. https mismatch causes an invalid\_grant error during OAuth.
{% endhint %}

#### Step 5: Activate the Application Against Your Production Tenant <a href="#step-5-activate-the-application-against-your-production-tenant" id="step-5-activate-the-application-against-your-production-tenant"></a>

Activation links your application to a specific Paycor legal entity. This step requires Company Admin, HR Admin, or Payroll Admin privileges.

1. Go to [hcm.paycor.com/AppActivation/ClientActivation](https://hcm.paycor.com/AppActivation/ClientActivation).
2. Enter the Application OAuth Client ID (from Step 2) and the Application Scope name (from Step 3, General tab).
3. Click **Initiate**.
4. Review the access scopes shown on the confirmation screen. These should match what you configured in Step 3.
5. Click **Next**.
6. Select the legal entity (client) you want to grant access to, then click **Integrate**.
7. Record the Legal Entity ID. This is the numeric identifier for the legal entity you selected — the Drivetrain team needs it to scope API calls.

{% hint style="warning" %}
If you see a 403 error, the signed-in user does not have the required administrator role.

Have an authorized administrator complete this step, or request the role from your Paycor account manager.
{% endhint %}

### Share Credentials with the Drivetrain Team <a href="#share-credentials-with-the-drivetrain-team" id="share-credentials-with-the-drivetrain-team"></a>

Send the following four values to the Drivetrain team using the secure intake link they provided. Do not share credentials over email, Slack, or any unencrypted channel.

| Credential                | Where to find it                                                                                 |
| ------------------------- | ------------------------------------------------------------------------------------------------ |
| Client ID                 | Application detail page, or the confirmation pop-up shown at creation in Step 2                  |
| Client Secret             | Captured at creation time in Step 2. Can be regenerated on the Security Connections tab if lost. |
| Ocp-Apim-Subscription-Key | Application Security Connections tab (Step 4)                                                    |
| Legal Entity ID           | Recorded during the activation step in Step 5                                                    |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://integrations.drivetrain.ai/integration-guide/readme/hris-and-ats/integrating-with-paycor.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.