API Authorization Service
The Authorization Service API enables secure authentication and authorization for accessing Sprout's core services. It provides access tokens for system-to-system authentication, which are required to interact with the following Full-Access and Restricted-Access APIs:
- Employee Service
- Time and Attendance
- HR General Service
- Payroll Service
Authentication Flow
Sprout's Authorization Service issues OAuth 2.0 tokens that must be included in the Authorization header when calling protected APIs.
The service supports three token types:
|
# |
Token Type |
Purpose |
|
1 |
HR Client Access Token |
System-to-system communication for Full-Access HR APIs |
|
2 |
Client Access Token |
System-to-system communication for Payroll and Restricted-Access APIs |
|
3 |
HR User Access Token |
Endpoints requiring user-level authentication (deprecated — avoid use in new integrations) |
Token Expiry and Renewal
|
Token Type |
Validity |
|
HR Client Access Token |
1 hour (3,600 seconds) |
|
Client Access Token |
15 minutes (900 seconds) |
Clients should refresh tokens before expiration to maintain uninterrupted access.
Error Handling
|
Status Code |
Description |
|
401 Unauthorized |
Invalid or expired token. Ensure the correct credentials are used. |
|
400 Bad Request |
Incorrect parameters in the request. |
Security Best Practices
- Never expose Client IDs and Secrets in frontend applications.
- Store tokens securely and refresh them as needed.
- Use HTTPS for all API requests and responses.
Got a question or need extra help? Sidekick makes it easy — get answers, raise a ticket, or schedule a call with our experts, all in one place.