SAP S/4HANA and Gusto integration

What moves between them

Employee and payroll data flows from Gusto into SAP S/4HANA. Employee records from Gusto are mapped to SAP business partners and cost center assignments so SAP headcount reflects Gusto hires and terminations. After each payroll run in Gusto, payroll totals are read and allocated to the SAP cost centers and GL accounts assigned to each employee, and the labor cost totals post into SAP's general ledger. Reference data such as locations and earning types are synced on a weekly schedule or on demand.

How ml-connector handles it

ml-connector stores the Gusto OAuth2 credentials and refreshes the access token before expiry since it has a 2-hour lifetime, and stores the SAP Communication Arrangement OAuth endpoint and Client Credentials to refresh SAP tokens on the same schedule. It validates Gusto webhook signatures via HMAC-SHA256 using the subscription verification token so only genuine payroll events trigger a sync. On the SAP side, it builds OData requests to read and write cost centers and GL account line items, handling the LastChangeDateTime filter for polling and the tenant-specific base URL. Payroll totals are reconciled against Gusto's payroll records before posting into SAP to catch allocation errors, and every record is tracked with a full audit trail so failed GL postings can be replayed.

A real-world example

A mid-size professional services firm runs SAP S/4HANA for finance and project costing, and uses Gusto for payroll across three locations. Before the integration, the finance team exported payroll registers from Gusto every two weeks and manually entered labor costs into SAP by cost center, then spent the first days of month-end reconciling SAP headcount against Gusto employee records and chasing differences in the labor accounts. With SAP S/4HANA and Gusto connected, each payroll run automatically flows into SAP and allocates labor costs to the correct project cost centers. New hires and terminations in Gusto are mirrored in SAP immediately, and month-end close starts with the labor accounts and headcount already reconciled.

What you can do

• •Sync Gusto employees into SAP S/4HANA cost centers and business partner records so headcount stays aligned.
• •Post Gusto payroll totals into SAP general ledger accounts after each pay run, mapped to the correct cost centers.
• •Validate SAP cost centers and GL accounts exist before posting payroll journal entries so invalid allocations are caught early.
• •Manage Gusto OAuth2 access token refresh and SAP OData Communication Arrangement credentials with secure encrypted storage.
• •Process Gusto payroll webhooks to trigger immediate syncs and maintain a full audit trail for every record.

Questions

Which direction does data move between SAP S/4HANA and Gusto?

The primary flow is Gusto into SAP S/4HANA. Employee records and payroll data move from Gusto into SAP cost centers and general ledger accounts. Gusto reads employee locations and pay schedule reference data from SAP for initial setup, and SAP sends no data back to Gusto. Both systems maintain their own employee and payroll records; the integration aligns them without overwriting.

How does the integration handle the different token lifetimes and OAuth flows?

Gusto uses a 2-hour access token with a non-expiring refresh token, while SAP S/4HANA tokens are typically 12 hours and require configuration in the Communication Arrangement. ml-connector manages both token types independently, refreshing Gusto's token every 90 minutes and SAP's before expiry, so neither system experiences auth failures mid-sync.

How does ml-connector ensure payroll data posts to the correct SAP GL accounts and cost centers?

Before posting any payroll journal entry, ml-connector validates that the mapped cost center and GL account exist in SAP S/4HANA via OData queries. Each employee's Gusto record carries a SAP cost center assignment, so payroll totals are grouped by cost center and posted to the matching GL account. If a cost center or account is missing, the record is held in a failed state with a full audit trail, and posting is retried once the mapping is corrected.