Skip to main content
Xoxoday Empuls supports OAuth2 authentication for all API connections, ensuring every integration with your enterprise tools meets modern security standards without exposing user credentials.
OAuth2 is the industry-standard authorisation framework for securing API access, and Xoxoday Empuls fully supports it across all API integrations. Rather than exchanging raw credentials between systems, OAuth2 allows Xoxoday Empuls to request scoped access tokens on behalf of your organisation — so the right data moves between platforms without ever storing sensitive login details on either side. When your IT team connects Xoxoday Empuls to an HRIS such as Workday, SAP SuccessFactors, or Darwinbox, the integration handshake follows the OAuth2 authorisation code flow. The connected system issues a short-lived access token, which Xoxoday Empuls uses to pull employee lifecycle data — new joiner records, department transfers, or exit events — automatically. Token expiry and refresh are handled without manual intervention, reducing the ongoing operational burden on your IT and people-ops teams. The same OAuth2 layer governs productivity tool integrations. When employees engage with Xoxoday Empuls through Slack or Microsoft Teams, the OAuth2 handshake ensures only the declared permissions are granted at the point of authorisation. An employee connecting the Empuls Slack app, for example, grants access only to the specific actions required for recognition workflows — peer nominations, milestone alerts, and reward redemption — nothing beyond that declared scope. For organisations operating under strict compliance mandates, OAuth2 support is a prerequisite rather than a feature. Xoxoday Empuls holds ISO 27001 certification and SOC 2 Type II attestation, both of which require third-party API access to follow industry-standard authorisation protocols. OAuth2 is central to satisfying those requirements, and its implementation within Xoxoday Empuls is reviewed and validated as part of each audit cycle. IT administrators can manage OAuth2 client configurations directly from the Xoxoday Empuls settings panel. Token scopes, redirect URIs, and client credentials are configurable per integration, giving your security team full visibility into what is authorised and the ability to revoke access instantly if a credential is compromised or a vendor relationship ends. For organisations connecting Xoxoday Empuls to custom-built internal tools or enterprise middleware, the API accepts OAuth2 bearer tokens following the RFC 6749 specification. This means any standards-compliant system your organisation already uses can integrate cleanly without bespoke authentication workarounds or proprietary SDKs. Learn more: [Xoxoday Empuls Help Centre — 6. SHARED CAPABILITIES](

Does Xoxoday Empuls support Single Sign-On (SSO)?

Learn how Xoxoday Empuls integrates with identity providers using SAML 2.0 and single sign-on to simplify employee access management.

Is Empuls ISO 27001 and SOC 2 certified?

Explore the ISO 27001 and SOC 2 Type II certifications that underpin Xoxoday Empuls’s enterprise-grade data security posture.