Oyster HR

Record your Oyster HR connection as hris evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Oyster HR:

   1. Log in to your Oyster production account and open the Developer tab (Developer applications page).
   2. Choose to create a new Oyster Developer App.
   3. Enter a Name, optionally a Description, and a Redirect URL (any publicly accessible https URL that loads in a browser without redirecting).
   4. Choose only the read scope; do not include unnecessary scopes.
   5. Submit. You receive the Client ID and Client secret. Oyster says to copy the Client secret before submitting the page, because it will not be visible in plain text again (you can regenerate a new one in the Developer applications list).
   6. Have a Company Admin click the app's Authorization URL on the Developer Applications page and authorize the app to access your company's data. The browser is redirected to your Redirect URL with a code parameter; copy that authorization code.
   7. Exchange the code for a token: POST to https://api.oysterhr.com/oauth2/token (application/x-www-form-urlencoded) with client_id, client_secret, grant_type=authorization_code, code and redirect_uri (must match exactly). The access_token in the response is the Bearer token; save the refresh_token too.
   8. Access tokens expire after 2 hours. Get a new one by POSTing grant_type=refresh_token with your client_id, client_secret and saved refresh_token to the same endpoint; each refresh returns a new access token and a new refresh token.

   Where to find the other values:

   • API token / Personal access token: The access_token value returned by POST https://api.oysterhr.com/oauth2/token.
   • Base URL (optional): https://api.oysterhr.com (the Oyster API host used in Oyster's docs).
   • Account / Org / Workspace (optional): Oyster's API docs name no account or workspace identifier for customer apps; the token is tied to the company that authorized the app. Leave blank.

   Oyster HR shows the secret only once, so copy it before you leave the page.

   Oyster's API uses OAuth2. The documented scopes are read, manage and subscribe; read is the least-privilege choice. Access tokens expire after 2 hours (expires_in 7200), so a pasted token needs regular refreshing. Oyster also supports the client_credentials grant, which has no refresh token, but access to it is restricted: email api-support@oysterhr.com to request it. A Developer Sandbox is available for testing; production data needs an app created in the production account.

   Source: docs.oysterhr.com, docs.oysterhr.com, docs.oysterhr.com, checked 2026-10-07.

2. On Compliance › Connectors, open Oyster HR, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Oyster HR yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• HRIS connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks