Authenticate to the Paylocity API using OAuth 2.0 client credentials and retrieve employee records for a company via the Core HR API.
domain: developer.paylocity.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Get approved for sandbox/API access through Paylocity (as an existing customer or via partner sponsorship) and receive an OAuth client ID/secret plus a company ID.
POST to the IdentityServer token endpoint (https://api.paylocity.com/IdentityServer/connect/token) using the OAuth 2.0 client credentials grant and the appropriate scope, sending the client ID and secret.
Extract the returned access token (Bearer, expires in 3600 seconds) from the JSON response.
Call GET /api/v2/companies/{companyId}/employees with the token in the Authorization header to list employees for that company (paginated).
Call GET /api/v2/companies/{companyId}/employees/{employeeId} to fetch a single employee's full record.
Re-run the client-credentials call to get a fresh token once the current one expires — there is no refresh-token grant.
Known gotchas
Every endpoint requires a companyId path parameter, which is a Paylocity-assigned company code (not a UUID) issued during onboarding.
SSN and other sensitive fields are masked in employee responses regardless of the scope your client was granted.
Paylocity's own guidance discourages polling the full employee list repeatedly — use employee webhooks plus the single-employee GET to track changes instead.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?