Configure Gusto webhooks and access basic payroll data via the Gusto API

Steps

1. Complete OAuth 2.0 authorization at https://api.gusto.com/oauth/authorize; Gusto uses a partner model — you must apply for API access and be approved before production credentials are issued.
2. Exchange the authorization code for tokens at https://api.gusto.com/oauth/token; access tokens expire — store the refresh token and use POST /oauth/token with grant_type=refresh_token to renew.
3. Register a webhook subscription by POSTing to https://api.gusto.com/v1/webhook_subscriptions with 'url', 'subscription_types' (array of event types like 'Employee.created'), and a shared secret for HMAC verification.
4. Retrieve companies accessible to the token with GET /v1/me, which returns the 'roles.payroll_admin.companies' array containing company UUIDs needed for subsequent calls.
5. Access payroll data with GET /v1/companies/{company_id}/payrolls?processed=true — this lists processed payroll periods; append '/{payroll_id}' for line-item detail including employee pay.
6. Validate incoming webhooks by computing HMAC-SHA256 of the raw request body using the shared secret and comparing it to the 'X-Gusto-Signature' header value.