How does ml-connector handle Paychex OAuth2 when there is no refresh token?

Paychex does not issue refresh tokens, so ml-connector re-acquires the access token proactively before expiry using the client credentials grant. This ensures the token is always valid before making API calls and eliminates the need to retry failed requests due to token expiry.

Does the integration require Paychex webhooks or can it poll instead?

Paychex webhooks are optional. ml-connector can listen for worker and company events when webhooks are enabled, but since Paychex webhook payloads are notification-only, it must fetch the full record via GET after each event. If webhooks are not available, ml-connector can poll pay periods on a schedule tied to your payroll calendar.

How does ml-connector prevent duplicate GL postings when Sage Intacct retries fail?

ml-connector uses the uniqueid flag in the Sage Intacct control block for server-side deduplication, and every payroll posting carries a full audit trail. If a GL posting fails and is retried, the same uniqueid ensures Sage Intacct does not create a duplicate entry.

Sage IntacctPaychex

Sage Intacct and Paychex integration

Sage Intacct runs your general ledger and financial dimensions. Paychex runs payroll and HR. Connecting them keeps labor costs and worker records in agreement across both systems. After each Paychex payroll run, ml-connector moves the labor allocation to Sage Intacct's GL, mapped to the correct cost centers and departments. Worker changes in Paychex keep your Sage Intacct headcount accurate, and compensation data aligns with your chart of accounts.

How Sage Intacct works

Sage Intacct exposes GL accounts, vendors, purchase orders, bills, AP payments, and cost dimensions through a single XML gateway endpoint at https://api.intacct.com/ia/xml/xmlgw.phtml. Authentication uses session-based credentials with senderId, senderPassword, companyId, userId, and userPassword. The initial session call returns a sessionid cached for 50 minutes, and HTTP 200 responses must be parsed for application-level errors inside the XML body. Sage Intacct does not support webhooks, so all reads are polling-based. The XML gateway requires all operations to serialize through one endpoint, and forbidden XML control characters must be stripped before escaping entity references.

How Paychex works

Paychex Flex exposes workers, jobs, organizations, locations, pay components, checks, and pay periods through REST APIs at https://api.paychex.com. Authentication uses OAuth2 client credentials without a refresh token, so access tokens must be re-acquired proactively before expiry. Paychex supports webhooks for worker and company events with domains WRKR_DEM, WRKR_CMP, WRKR_EMPL, WRKR_ADD, and CLT_ACCESS, but webhook payloads are notification-only and do not include changed data, so ml-connector must fetch the full record via GET after each event. Webhook security uses Basic Auth, API Key, OAuth2, or OAuth2 Basic, and Paychex retries webhooks every 5 minutes on non-2XX responses.

What moves between them

The primary flow runs from Paychex into Sage Intacct. After each payroll run, ml-connector reads Paychex pay components and checks, maps them to Sage Intacct GL accounts and cost dimensions, and posts the labor cost journal. Worker records from Paychex, including job codes and organization assignments, flow into Sage Intacct dimensions so that GL allocations land on valid cost centers. Reference data such as organizations, locations, and job codes are aligned in both directions to ensure consistency. Paychex data drives the sync on a schedule tied to your payroll calendar, while Sage Intacct serves as the source of truth for GL account validity and dimension hierarchies.

How ml-connector handles it

ml-connector obtains a Paychex OAuth2 access token using client credentials and re-acquires it proactively before expiry, since Paychex does not issue refresh tokens. It listens for Paychex webhooks and fetches the full record via GET when worker or company events arrive. On the Sage Intacct side, ml-connector calls getAPISession once per session to exchange credentials for a sessionid, caches that sessionid for its 50-minute lifetime, and automatically refreshes on the next call if it expires. All XML payloads are scrubbed of forbidden C0 control characters before being posted to the XML gateway. Cost dimensions and GL accounts are aligned first in both directions, so every payroll line posted to Sage Intacct references an account and cost center that already exists. Paychex worker records are mapped to Sage Intacct dimensions using the uniqueid flag in the control block for deduplication across retries. Every record carries a full audit trail, and failed GL postings can be retried without double-posting.

A real-world example

A mid-sized professional services firm runs Sage Intacct for financial accounting and GL management, and uses Paychex Flex for payroll and HR across multiple offices. Before the integration, the accounting team exported payroll registers from Paychex each month and manually re-entered labor allocations into Sage Intacct by GL account and office cost center, which introduced data-entry errors and delayed month-end close. With Paychex and Sage Intacct connected, payroll GL postings flow automatically to the correct cost center after each run, worker hires and terminations in Paychex keep the dimension tables in sync, and the accounting team starts month-end with labor accounts already reconciled.

What you can do

Post Paychex payroll GL allocations into Sage Intacct's general ledger after every pay run, mapped to the correct GL accounts and cost dimensions.
Keep Sage Intacct worker records and cost center dimensions aligned with Paychex employee data, jobs, and organizations.
Manage Paychex OAuth2 client credentials and proactively refresh the access token before expiry to avoid interruptions.
Handle Sage Intacct session-based authentication, cache the sessionid for its 50-minute lifetime, and auto-refresh on the next call.
Parse Paychex webhook events for worker and company changes, fetch the full record, and validate GL dimensions before posting to Sage Intacct.

Questions

How does ml-connector handle Paychex OAuth2 when there is no refresh token?: Paychex does not issue refresh tokens, so ml-connector re-acquires the access token proactively before expiry using the client credentials grant. This ensures the token is always valid before making API calls and eliminates the need to retry failed requests due to token expiry.
Does the integration require Paychex webhooks or can it poll instead?: Paychex webhooks are optional. ml-connector can listen for worker and company events when webhooks are enabled, but since Paychex webhook payloads are notification-only, it must fetch the full record via GET after each event. If webhooks are not available, ml-connector can poll pay periods on a schedule tied to your payroll calendar.
How does ml-connector prevent duplicate GL postings when Sage Intacct retries fail?: ml-connector uses the uniqueid flag in the Sage Intacct control block for server-side deduplication, and every payroll posting carries a full audit trail. If a GL posting fails and is retried, the same uniqueid ensures Sage Intacct does not create a duplicate entry.

Connect Sage Intacct and Paychex

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started