---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: Extend
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Steps: Set Up WCP Integration System User Authentication (WCPISU)
layout: subsection
---

### Prerequisites

<a id="prereq_N10021_N1001E_N10001"></a>
-   An Integration System User (ISU) on your tenant.
-   An HTTP REST API client tester, such as Postman.
-   A Base64 encoding tool.


Security: <i>Security Administration</i> domain in the System functional area.

### Context

<a id="context_N10027_N1001E_N10001"></a>
Certain Workday REST API endpoints and the underlying reports and tasks they execute should run as preconfigured authorized ISUs. The WCPISU authentication uses the ISU credentials with endpoint requests.

<b>Note:</b> The `WCPISU` authentication type is a legacy mechanism for authenticating apps with an ISU user. Instead of using `WCPISU`, Workday recommends the simplified `ISU` authentication type, which is an improved and simpler version. Existing apps with Presentation Components can continue using `WCPISU`, but new apps must use `ISU`. Workday strongly recommends that existing apps migrate to `ISU`. To migrate an existing app to `ISU`:

1.  Add the `ISU` authentication scheme to `authTypes` in the SMD.
2.  Update the PMD endpoint definitions that use `WCPISU`. Replace the `authType` value with the `id` of the ISU scheme declared in the SMD.


See [Steps: Set Up ISU Authentication for Apps](/wcp_docs/GUID-3277fec3-24c9-41da-9840-c61b41033f28-enHYPHENus.html).

### Steps

1.  <a id="step_N10050_N1004D_N1001F_N10001"></a>[Create Your API Client](/wcp_docs/zwx1518028675482.html).

    Make note of the client ID and client secret of your app. You need this information when you get a refresh token for the credential store.

2.  <a id="step_N10060_N1004D_N1001F_N10001"></a>[Get a Refresh Token for WCPISU Authentication](/wcp_docs/bby1527491420006.html).
3.  <a id="step_N10057_N10032_N1001E_N10001"></a>[Create External Client CredStore](/wcp_docs/gqs1527493104452.html#).

    Use the Workday credential store for storing refresh tokens for the ISU user.

4.  <a id="step_N10064_N10032_N1001E_N10001"></a>In the SMD of your custom app, add the `WCPISU` authentication type.

    Example:

    ```
    "siteAuth": {
    "authTypes": [
    {
      "id" : "wcpisu1",
      "scheme" : "WCPISU",
      "appId" : "myApp",
      "tokenHolder" : "devSystemUser",
      "checkEnvironment" : "true"
    }
    ],
    "defaultId": "wcpisu1"
    },
     
    ```

    For attribute details, see [Reference: Workday Integration System User (Legacy WCPISU)](/wcp_docs/rzc1537922580355.html).

5.  <a id="step_N10091_N1004D_N1001F_N10001"></a>For each PMD endpoint using the `WCPISU` authentication type, set its `authType` to the `id` of the WCPISU scheme in the SMD.

    Example:

    ```
    "endPoints": [
    {
    "name" : "mySample",
    "baseUrlType" : "localhost",
    "url" : "/sampleData/list",
    "authType" : "wcpisu1"
    }
    ],
     
    ```



### Result

<a id="result_N10092_N1001E_N10001"></a>
Once you've completed these steps, Presentation Components first get the access token through the preconfigured ISU Refresh Token. Then the endpoint will use the access token to authenticate.

### Next Steps

<a id="postreq_N1009E_N1001E_N10001"></a>
Validate your app and push it to the Development tenant to test your code.