Wave Accounting and UKG integration

What moves between them

The main flow runs from UKG into Wave. After each payroll run, ml-connector reads UKG's GL payroll journal entries and posts them into Wave's chart of accounts, mapped to the matching Wave customer accounts and the cost centers that UKG provides. Employee records from UKG flow into Wave so that customer records reflect the current workforce, and cost centers align in both directions. Wave's invoices and transactions are readable but not modified by the integration, since payroll GL posting is the primary flow. ml-connector polls UKG on a schedule aligned with your payroll calendar to catch all GL entries and employee changes.

How ml-connector handles it

ml-connector stores Wave's OAuth2 refresh token and refreshes the access token automatically when it nears expiry, since access tokens are valid for 2 hours. On the UKG side, it presents the HTTP Basic Auth credentials and custom API keys on every request, and refreshes the OAuth token if configured for Webhooks Premium. ml-connector validates all Wave webhook signatures with HMAC-SHA256 and the x-wave-signature header, and it acknowledges each webhook with HTTP 200 to prevent Wave from retrying. Cost centers from UKG are fetched and mapped first, so every payroll GL entry references an account and customer that already exists in Wave. UKG webhook events have 14-day retention, so ml-connector supplements webhook delivery with polling against UKG's delta endpoint to ensure zero-tolerance integrations do not miss changes during a gap. Every record carries a full audit trail and can be replayed if a downstream posting fails.

A real-world example

A small professional services firm uses Wave Accounting for invoicing and general ledger management, and UKG for payroll across a single office with fifteen employees. Before the integration, the owner exported payroll registers from UKG every pay period and manually entered the labor cost totals into Wave's GL. The process was error-prone and added 2-3 hours to month-end close. With UKG and Wave connected, payroll GL entries flow into Wave automatically after each pay run, mapped to the correct customer accounts and cost centers. The firm now reconciles payroll costs in seconds, and the manual entry step is gone.

What you can do

• •Post UKG payroll GL entries into Wave's chart of accounts after every pay run, mapped to the correct customers and cost centers.
• •Keep Wave's customer records aligned with UKG employee hires, terminations, and status changes.
• •Map UKG cost centers and compensation details to Wave's accounting dimensions so payroll lands on valid accounts.
• •Authenticate Wave with OAuth2 refresh token logic and UKG with HTTP Basic Auth or OAuth2 client credentials.
• •Poll on a schedule tied to your payroll calendar, with webhook signature verification and a full audit trail on every record.

Questions

Which direction does data move between Wave and UKG?

The main flow is UKG into Wave. Payroll GL entries and employee records move from UKG into Wave, while cost centers and customer accounts are aligned in both directions. Wave invoices and transactions are read but not modified, since payroll GL posting is the primary use case.

How does the integration handle Wave's OAuth2 token expiry and webhook signature verification?

ml-connector stores the refresh token and automatically refreshes the access token before it expires, since Wave access tokens are valid for 2 hours. Every webhook is verified with HMAC-SHA256 using the x-wave-signature header, and each webhook is acknowledged with HTTP 200 to prevent Wave from retrying the same event.

What happens if UKG webhooks are missed or delayed?

UKG webhook events are retained for 14 days, so ml-connector supplements webhook delivery by polling UKG's delta endpoint on your payroll schedule. This ensures that zero-tolerance integrations do not miss GL entries or employee changes during a webhook gap.