Personio HR

This connector uses the Personio v1 REST API.

Authentication model — IMPORTANT: Personio's /auth endpoint is not a standard OAuth2 flow. You POST {client_id, client_secret} once and get back a short-lived bearer token, which is then passed as Authorization: Bearer <token> on every request. Each successful API response ALSO returns a new token in its Authorization response header that must be used for the next call — effectively a token-rotation scheme. This adapter uses a single long-lived bearer token supplied by you (PERSONIO_TOKEN).

Getting a token: in Personio admin → Settings → Integrations → API credentials, create a new set, then exchange them for a token via curl -X POST https://api.personio.de/v1/auth -d 'client_id=...&client_secret=...'. Paste the returned token as PERSONIO_TOKEN when importing the connector.

Token rotation limitation: because the adapter sends the SAME token on each call, the first call succeeds but subsequent ones may fail once Personio starts rotating. In practice Personio tolerates the same token for a few minutes — good enough for ad-hoc AI workflows but not high-volume integrations. For production, generate a fresh token per session or wrap this adapter in a custom proxy.

Scopes: the token inherits the API credential's configured scopes (Employees, Attendances, Absences, Time Offs). Configure these in Personio before generating the token.

Rate limit: 10 requests/second per API credential.