Home / Integrations
Connect your payroll data to FairCheck
Two ways in: push pay runs to our signed webhook from your own systems, or connect an off-the-shelf payroll app and we'll pull the data for you — then run every payslip through compliance automatically.
Choose your payroll platform
Pick the system you run payroll in. We'll walk you through a read-only connection — no payroll changes, no exporting spreadsheets.
Xero Payroll
Accounting & Payroll
Pull employees, pay runs and payslips straight from Xero Payroll (AU).
MYOB AccountRight
Workforce & Time
Import timesheet hours by date, so weekend and overtime work hidden inside an "Ordinary" line can still be checked against payslips you upload.
Employment Hero (KeyPay)
Payroll
Import pay runs plus rostered and actual hours, so weekend and overtime work hidden inside an "Ordinary" line can still be checked.
Deputy
Workforce & Time
Bring in rostered hours and timesheets to cross-check against payslips.
QuickBooks Payroll
Accounting & Payroll
Import pay cheques and employee data from QuickBooks Online Payroll.
Reckon Payroll
Payroll
Sync Reckon Payroll pay runs for automated compliance checks.
ADP
Payroll
Enterprise payroll sync from ADP via the ADP Marketplace.
Don't see your platform? Push data via webhook or ask us to add it.
Send pay runs to our webhook
Built your own payroll, or want full control? POST signed pay-run payloads to FairCheck and we'll ingest and check each payslip. Every request is authenticated end-to-end.
Endpoint
https://faircheck.com.au/webhooks/payroll
Webhook key
Sent as X-Faircheck-Key so we know which account is pushing. Safe to embed in config.
Signing secret
Used to compute the request signature. Treat it like a password — never expose it client-side.
Your real keys are hidden
Log in to reveal your account's webhook key and signing secret, copy them, and rotate them anytime.
BODY='{"employee":{"name":"Jane Citizen","award_code":"MA000004"},
"pay_period":{"start":"2026-06-01","end":"2026-06-14"},
"gross":2480.00,"hours":76,"lines":[...]}'
TS=$(date +%s)
SIG="sha256=$(printf '%s.%s' "$TS" "$BODY" \
| openssl dgst -sha256 -hmac "$FAIRCHECK_SECRET" -hex \
| sed 's/^.* //')"
curl -X POST https://faircheck.com.au/webhooks/payroll \
-H "Content-Type: application/json" \
-H "X-Faircheck-Key: whkey_••••••••••••••••••••••••" \
-H "X-Faircheck-Timestamp: $TS" \
-H "X-Faircheck-Signature: $SIG" \
-d "$BODY"Response codes
- 202
- Accepted — queued for compliance
- 400
- Malformed payload
- 401
- Missing / invalid signature or stale timestamp
- 409
- Duplicate (idempotency key seen)
- 429
- Rate limited — retry with backoff
Headers we require
X-Faircheck-Key— your account's webhook key (whkey_…)X-Faircheck-Signature— HMAC-SHA256 of"<timestamp>.<raw body>"X-Faircheck-Timestamp— unix seconds, ±5 minIdempotency-Key— your unique id per payslip (optional but recommended)Content-Type—application/json
The full security path
Every byte that enters FairCheck is verified before it touches a queue. Here's exactly what happens to a request — and the controls behind it.
TLS only
Requests are accepted over HTTPS (TLS 1.2+) exclusively. Plain HTTP is refused at the edge.
HMAC-signed body
We recompute the SHA-256 HMAC of the raw body with your secret and compare in constant time. No match → 401, fail-closed.
Replay protection
The signed timestamp must be within ±5 minutes. Old or reused requests are rejected even with a valid signature.
Idempotency
Send an Idempotency-Key per payslip. We de-duplicate so a retry never double-checks a pay run.
IP allowlisting
Optionally restrict delivery to your egress IP ranges for a second layer beyond the signature.
Secret rotation
Rotate signing secrets anytime with a 24-hour overlap window so you can roll keys with zero downtime.
What happens to a request
Verify timestamp
Reject anything older than 5 minutes before doing any work.
Verify signature
Constant-time HMAC-SHA256 check against your secret.
De-duplicate
Skip payslips we've already seen via the idempotency key.
Queue & check
Hand off to the compliance pipeline; respond 202 immediately.
We never store your signing secret in plaintext, and payload data is encrypted at rest. See the security overview.
Integration FAQ
Is the connection read-only?
Yes. Every app integration requests read-only scopes — FairCheck never writes back to your payroll system or changes pay.
How fast do payslips get checked?
Pushed payslips are queued the moment they're accepted (HTTP 202) and typically checked within a minute. App syncs poll completed pay runs on a schedule.
What if a delivery fails?
Webhook senders should retry non-2xx responses with exponential backoff. Use an Idempotency-Key so retries never create duplicates.
Can I rotate or revoke access?
Rotate the webhook signing secret anytime with a 24-hour overlap, and disconnect any app integration from this page to revoke its token immediately.