Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-07-10
Authenticate Agents to Agent Gateway

Authenticate Agents to Agent Gateway

  • Register and activate your agent with Agent System of Record (ASOR) using the agent registration API. See Register External Agents. Note these values:
    • Client ID.
    • Client Secret.
    • Redirect URI for delegate agents.
    • x509 Public Key for ambient agents.
All agents must use Agent Gateway to interact with Workday. For the Agent Gateway to route requests to the correct Workday data center, it must know the alias of your tenant. You must provide your tenant alias with all agent API requests, including requests for authentication. Your tenant alias is typically the name of your tenant, and can be found in the URL of your Workday instance: https://wd8.myworkday.com/<tenantalias>/d/home.html.
To direct all relevant API calls to your assigned Agent Gateway endpoint, you must modify your agent's code or configuration.
For more details on authentication, see Configure External Agents.
  1. To request an authorization code, send an HTTPS GET request to the authorization endpoint in Agent Gateway.
    Send this request in your browser and sign in if requested: 
    https://us.agent.workday.com/auth/authorize/<Tenant Alias>?client_id=<OAuth_Client_ID>&response_type=code
    Substitute endpoints based on your region.
    The Agent Gateway will send this request to the Auth Gateway in the data center where your tenant is located, using the Tenant Alias in the request. The Auth Gateway will then redirect you to a Workday login pop-up, to authenticate. After a successful login and consent for the agent to access Workday data, your agent will receive an authorization code.
  2. Copy the authorization code value from the response.
  3. To request an access token, send a POST request to the token endpoint in Agent Gateway.
    Fill in the Client ID and Client Secret you noted from ASOR, your tenant alias, and the authorization code.
    Substitute endpoints based on your region.
    POST  https://us.agent.workday.com/auth/oauth2/<Tenant_Alias>/token

grant_type=authorization_code
code=<authorization_code>
client_id=<OAuth_Client_ID>
client_secret=<OAuth_Client_Secret>
Your agent receives an access token and is now authorized to interact with Workday through Agent Gateway.