Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-11-13
Register API Client for Data Lake (Token Exchange Grant)

Register API Client for Data Lake (Token Exchange Grant)

  • See the Data Lake Setup in Workday section of Get Started with Workday Data Lake. This topic is part of a larger procedure.
  • Security:
    • Integration Security
       domain in the Integration functional area.
    • Set Up: Tenant Setup - Security
       and
      Security Administration
       domains in the System functional area.
Data Platform Clients authenticate their connection to Workday Data Lake through API clients. Depending on the connector options in the data platform, you can either establish your connection with a:
  1. Access the
    Register API Client
     task.
    1. Complete the task:
      Option
      Description
      Client Name
      Enter a unique API client name.
      Client Grant Type
      Select
      Token Exchange Grant
      .
      Integration System User
      Select an ISU.
      You can change the ISU after the API Client is registered to reflect the service account identifiers that your IDP may generate.
      OAuth 2.0 Audience
      Select
      workday-data-cloud
      .
      Access Token Type
      Select
      Bearer
      .
      Scope
      Select
      Data Cloud
      . If this option doesn't display, see Set Up the Data Cloud Functional Area.
      OAuth 2.0 Client 3rd Part JWKS URI Type
      Select
      OIDC
      .
      Issuer URI
      Enter the Issuer URI of your IDP. Example:
      https://accounts.google.com
    2. Click
      OK
      .
  2. Save the API Client information from the
    Register API Client
     page.
    You'll need this information to configure Workday connector properties in the partner platform:
    Information
    Example or Details
    Integration System User
    demo-isu
    Client ID
    BASE64_CLIENT_ID Sample Value: OTc3MmE4ZmEt...[TRUNCATED_FOR_EXAMPLE]...bUxZjIz
To integrate with an external IDP, you need to use the service ID generated by the IDP as the ISU name in Workday. Once you have this information, either:
  • Update the name of the ISU that you selected on the API client.
  • Create a new ISU using the IDP service principal ID as its name and add this ISU to the API client.
For the next step in the Workday-side Data Lake setup flow, see Set Up Security for Data Lake Admin Console.