Epicor Kinetic and Paychex integration

What moves between them

Data flows in two directions. Worker records and job assignments move from Paychex into Epicor Kinetic so your employee roster stays current with hires, terminations, and role changes. Pay components and cost allocations from Paychex payroll runs are mapped to Epicor GL accounts and cost centers, allowing labor cost journals to post automatically after each pay cycle. Reference data such as locations and pay frequencies are synchronized in both directions to ensure payroll allocations land on valid Epicor dimensions.

How ml-connector handles it

ml-connector stores both credential sets encrypted: Paychex OAuth2 credentials and Epicor API Key with Basic Auth. On the Paychex side it receives webhook events for worker changes and company access, but because webhook payloads lack detailed data, it fetches the full worker and payroll records via GET requests. On the Epicor side it polls GL accounts and cost centers using OData filters on UpdatedOn to retrieve only records changed since the last sync. When Epicor Bearer tokens expire (typically ~1 hour), ml-connector refreshes before the token becomes invalid. Paychex workers are deduped by their unique workerID and matched to Epicor vendor or customer records by a mapping you configure. Every payroll cost allocation is validated against Epicor's GL account and cost center dimensions before posting, and a full audit trail tracks each record.

A real-world example

A mid-sized manufacturing company runs Epicor Kinetic for production planning and finance, with locations across two states. They use Paychex Flex for payroll and HR. Before the integration, the accounting team manually exported Paychex payroll summaries after each pay run, looked up the correct cost centers in Epicor for each location, and hand-entered labor cost journals into the general ledger. Payroll-to-ledger reconciliation during month-end close took several days and often surfaced gaps between what Paychex said was paid and what landed in Epicor. With Epicor and Paychex connected, each payroll cycle's allocations post automatically to the correct Epicor GL accounts and cost centers, worker hires and terminations sync into the ERP headcount, and month-end close begins with payroll labor costs already reconciled.

What you can do

• •Receive Paychex worker and pay events, fetch full payroll detail, and map cost allocations into Epicor Kinetic GL accounts by cost center.
• •Poll Epicor GL accounts, cost centers, and vendor dimensions to align with Paychex payroll allocations.
• •Authenticate Paychex with OAuth2 client credentials and Epicor with API Key plus Basic Auth, with proactive token refresh.
• •Handle Paychex webhook retries and Epicor OData polling on a configurable schedule tied to your pay cycle.
• •Track every payroll posting and worker change with a full audit trail and replay any failed downstream record.

Questions

How does the integration handle the fact that Paychex webhook payloads do not include full data?

Paychex webhooks notify ml-connector of worker and company events, but the payloads contain only metadata. ml-connector immediately fetches the full worker record via GET /workers/{workerID} or the full company record when access changes. This ensures complete data is available for mapping into Epicor without relying on incomplete webhook bodies.

Which direction does data move between Epicor Kinetic and Paychex?

The main flow is Paychex into Epicor Kinetic. Worker records, jobs, locations, and payroll cost allocations move from Paychex into Epicor so your general ledger captures labor costs and your headcount stays current. Reference data such as cost centers and locations are aligned in both directions to ensure Paychex payroll allocations land on valid Epicor dimensions.

How does the integration handle Epicor's API Key and token expiry requirements?

ml-connector stores the Epicor API Key header encrypted alongside Basic Auth credentials and uses them on every request. Bearer tokens issued by Epicor's Token Resource Service expire in approximately one hour, so ml-connector proactively refreshes the token before expiry to prevent outages. Paychex OAuth2 tokens have no refresh mechanism, so ml-connector re-acquires a new access token before the current one expires.