Plex and Gusto integration

What moves between them

Employee records, job codes, and pay-schedule references flow from Gusto into Plex. When a new hire is created in Gusto, the employee record flows into Plex with a reference to the job code and location. Pay schedule changes in Gusto trigger updates in Plex so cost allocations stay aligned with the schedule. Optionally, after each Gusto payroll run completes, ml-connector reads the calculated labor totals per job code and location, maps them to the corresponding Plex GL account and cost center, and posts the labor cost journal into Plex's general ledger. This reverse flow is read-only in the sense that Gusto cannot be modified; all changes originate in Gusto and cascade into Plex.

How ml-connector handles it

ml-connector stores both credential sets encrypted and manages the OAuth flows on each side: the Gusto side uses a three-hour refresh cycle with token rotation, and the Plex side caches the bearer token until expiry or a 401 response. Every Gusto customer account is routed to the correct Plex company using the PCN (company code) specified at setup, since Plex partitions data by PCN in the SOAP interface and some REST endpoints require it. When Gusto webhooks are enabled, ml-connector verifies the HMAC-SHA256 signature using the Gusto-supplied subscription token on each payroll or employee event. ml-connector maps Gusto job codes and pay schedules to Plex GL accounts and cost centers before posting labor cost allocations, so every debit and credit lands on a valid GL account dimension. Because Plex does not publish rate limits but does not document idempotency either, ml-connector uses unique external reference identifiers (such as Gusto payroll run IDs) to detect and skip duplicate loads. Gusto's 200-request-per-minute rate limit is observed on the client side with backoff.

A real-world example

A mid-sized discrete manufacturer with plants in three states uses Plex for production, procurement, and finance, and Gusto for centralized payroll and HR. Before the integration, the HR team exported employee rosters from Gusto monthly, and the finance team manually cross-checked headcount against the GL labor accounts in Plex, which often did not agree. After each payroll run, the finance team recalculated labor cost breakdowns by location and job code, then re-entered the totals into Plex by hand. With Plex and Gusto connected, each new hire, termination, or pay rate change in Gusto automatically reflects in Plex's employee records, and after each payroll run the labor cost allocations flow into Plex's GL without re-keying. Month-end close starts with headcount and labor accounts already reconciled.

What you can do

• •Sync employee records from Gusto into Plex with job codes and pay schedules so Plex headcount stays current.
• •Map Gusto job codes and locations to Plex GL accounts and cost centers before any downstream posting.
• •Receive and verify Gusto webhook signatures for payroll, employee, and company events in real time.
• •Post calculated labor cost allocations from Gusto into Plex's general ledger after each payroll run, allocated to the correct cost center.
• •Manage OAuth2 token refresh on both sides and validate Gusto tokens against Plex's PCN routing so the correct company data is always used.

Questions

Which direction does data move between Plex and Gusto?

The main flow is Gusto into Plex. Employee records, job codes, and pay-schedule references move from Gusto into Plex so your workforce records stay in sync. Optionally, after each payroll run, calculated labor cost totals flow back into Plex's general ledger, mapped to Plex GL accounts and cost centers. Gusto is never modified; all changes originate in Gusto.

How does ml-connector handle the different auth models on Plex and Gusto?

ml-connector manages both OAuth2 flows separately. On the Gusto side, it tracks the two-hour access token expiry and uses the single-use rotating refresh token to obtain a new token before the old one expires. On the Plex side, it caches the OAuth2 bearer token and refreshes it when a call returns 401. Gusto tokens are company-scoped, and Plex uses a company code (PCN) to route to the correct data partition, so ml-connector keeps both in sync.

What happens if a Gusto employee or payroll event is missed?

ml-connector stores encrypted Gusto OAuth credentials and verifies webhook signatures with HMAC-SHA256 using Gusto's subscription token. If a webhook is missed or fails, ml-connector can poll the Gusto API on a configurable schedule to catch up. For payroll GL postings, each posting includes a unique reference ID from the Gusto payroll run, so duplicate loads are detected and skipped.