Integration Guide
Connecting your ERP to ERPOps
This guide covers the two main connection patterns, supported authentication methods, and prerequisites. Step-by-step connector setup — including field-level configuration for each gateway — is inside the app.
Prerequisites
- An ERPOps account (free tier or above)
- API access or integration user credentials for your ERP
- Your ERP's base URL or Integration Broker endpoint
- Outbound HTTPS (port 443) access from your ERP to api.erpops.ai — for webhook push patterns
- For OAuth flows: ability to register an OAuth client application in your ERP's admin console
- For mTLS: a client certificate issued by your organization's CA
Supported authentication methods
ERPOps supports the authentication method your ERP natively uses — you do not need to change your ERP's security model.
| Auth Method | Supported ERPs | Notes |
|---|---|---|
| OAuth 2.0 Client Credentials | Workday, Oracle HCM Cloud, SAP SuccessFactors | Recommended for cloud ERPs. Client ID + secret stored encrypted in ERPOps vault. |
| OAuth 2.0 + mTLS | Oracle Integration Cloud, SAP BTP | Mutual TLS adds certificate-based client identity on top of OAuth. |
| API Key / Basic + Key | NetSuite, Microsoft Dynamics, ADP, UKG | API key or username/password+key pair. Encrypted at rest. |
| HMAC Webhook (inbound) | All platforms via tenant-push model | Tenant ERP pushes signed events to ERPOps. No inbound firewall changes needed on tenant side. |
| SAML Bearer Assertion | PeopleSoft (IB), Oracle EBS | SAML token exchanged for OAuth access token. |
| mTLS (certificate only) | Federal / on-prem PeopleSoft, JDE | Client certificate provisioned by tenant IT. No shared secret. |
Connection patterns
Pattern A — Tenant-Initiated Outbound (Webhook Push)
RecommendedYour ERP or middleware sends signed events outbound to ERPOps. ERPOps never initiates a connection to your network. No IP allowlisting needed on your firewall — trust is established via HMAC signature on each request.
- 1Create a connector in ERPOps admin app — system generates a unique Connector ID and HMAC secret
- 2Configure your ERP or middleware to POST events to https://api.erpops.ai/functions/v1/receive-event
- 3Include X-ERPOps-Connector-Id and X-ERPOps-Signature headers on each request
- 4ERPOps validates the HMAC signature and ingests the event
📖 Full step-by-step setup with field-level guidance is available in the admin app at app.erpops.ai/docs after sign-up.
Pattern B — ERPOps Polls Your ERP API
CommonERPOps calls your ERP's REST or SOAP API on a schedule to pull connector health, job status, and log data. Requires API credentials but no inbound firewall change on ERPOps's side.
- 1Provision an integration user or OAuth client in your ERP with read-only API access
- 2Enter credentials in ERPOps connector setup (encrypted at rest, never logged)
- 3ERPOps begins scheduled polling — interval configurable per connector
- 4If your ERP sits behind a firewall requiring IP allowlisting, see the Network & Security guide for options
📖 Full step-by-step setup with field-level guidance is available in the admin app at app.erpops.ai/docs after sign-up.