---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: Extend
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Reference: Workday Integration System User (Legacy WCPISU)
layout: subsection
---

## <a id="section_wcpIsu"></a>Workday Integration System User (Legacy WCPISU)

<b>Note:</b> The `WCPISU` authentication type is a legacy mechanism for authenticating apps with an ISU user. Instead of using `WCPISU`, Workday recommends the simplified `ISU` authentication type, which is an improved and simpler version. Existing apps with Presentation Components can continue using `WCPISU`, but new apps must use `ISU`. Workday strongly recommends that existing apps migrate to `ISU`. To migrate an existing app to `ISU`:

1.  Add the `ISU` authentication scheme to `authTypes` in the SMD.
2.  Update the PMD endpoint definitions that use `WCPISU`. Replace the `authType` value with the `id` of the ISU scheme declared in the SMD.


See [Steps: Set Up ISU Authentication for Apps](/wcp_docs/GUID-3277fec3-24c9-41da-9840-c61b41033f28-enHYPHENus.html).

Use the `WCPISU` authentication scheme to enable your custom app to use a preconfigured authorized Integration System User (ISU) on your tenant. Presentation Components authenticate a PMD endpoint request with a preconfigured access token in the Workday credential store.

A Workday administrator must store your WCP client credentials and ISU refresh tokens using the <b>Create External Client CredStore</b> task on Workday. For more information, see [Steps: Set Up WCP Integration System User Authentication (WCPISU)](/wcp_docs/sha1524170857897.html).

## <a id="section_orw_ldw_sfb"></a>SMD authType Attributes

<table><thead><tr><th>Attribute</th><th>Value</th></tr></thead><tbody><tr><td>id</td><td>The ID of this <code>authType</code> entry. PMD endpoints use this ID to reference which <code>authType</code> to use for endpoint authentication. <p>If you're using multiple WCPISU users, assign a unique <code>id</code> for each WCPISU user. The WCPISU auth <code>id</code> must be unique across custom apps.</p></td></tr><tr><td>scheme</td><td><code>WCPISU</code> (case-sensitive)</td></tr><tr><td>appId</td><td>Specify the app reference ID with the postfixed company ID. You see the app Reference ID on the <b>Workday Extend App Manager</b> worklet. <p>Ensure that <code>appId</code> matches the <b>App ID</b> defined in the Workday credential store. The credential store uses the <code>appId</code> and <code>tokenHolder</code> to identify the correct refresh token.</p></td></tr><tr><td>tokenHolder</td><td>Specify the ISU user Id. This value is the same as the <b>Token Holder</b> defined in the Workday external client credential store. The credential store uses the <code>appId</code> and <code>tokenHolder</code> to identify the correct refresh token.</td></tr><tr><td>checkEnvironment</td><td>If <code>true</code>, WCPISU authentication restricts the scope of the refresh token to the specified tenant environments in the Workday external client credential store. <p>For non-development customer environments, we recommend that you set <code>checkEnvironment</code> to <code>true</code> to ensure that the refresh tokens apply to the correct environments. Specify the environments in the <b>Create External Client CredStore</b> or <b>Edit External Client CredStore</b> task. The <code>checkEnvironment</code> attribute along with the Credential Store ensures that the WCPISU connects only to the specified environments.</p> <p>Default is false. By default, WCPISU uses the refresh token for all environments.</p><p><b>Note:</b> For <b>Sandbox</b> and <b>Sandbox Preview</b> tenants: On the external client credential store, create refresh tokens in <i>both</i> Sandbox and Sandbox Preview tenants. If you created business objects in Sandbox Preview but don't have refresh tokens in Sandbox Preview, you'll encounter HTTP 500 errors when accessing those business objects. If you've only created refresh tokens in the Sandbox tenant, you can only access the business objects in Sandbox.</p></td></tr></tbody></table><br/>

## <a id="section_rrj_ndw_sfb"></a>Example

```
"siteAuth": {
"authTypes": [
{
"id" : "wcpisu1",
"scheme" : "WCPISU",
"appId" : "myApp_ycjtxv",
"tokenHolder" : "devSystemUser",
"checkEnvironment" : "true"
},
{
  "id" : "sso",
  "scheme" : "SSO"
}
]
},
```

<b>Note:</b> The default authentication type is always `SSO`. To override `SSO` with the `WCPISU` authentication type, specify its `id` in the `authType` attribute of the endpoint in the PMD.

### Related Information

[Steps: Set Up WCP Integration System User Authentication (WCPISU)](/wcp_docs/sha1524170857897.html)

[Declare Authentication Types in the SMD](/wcp_docs/nyw1530545468565.html)

[Define Endpoint Authentication in the PMD](/wcp_docs/yea1530546235609.html)