# Worklio > Embedded US payroll from Worklio, Inc. for software platforms, PEOs and payroll bureaus. A partner's backend creates companies and workers, runs payroll in steps and reads tax forms through a REST API, with white-label screens as an alternative. - Canonical: https://www.anchorterminal.com/tools/worklio - Markdown: https://www.anchorterminal.com/tools/worklio.md (~6,800 tokens) - Slim: https://www.anchorterminal.com/tools/worklio.min.md (~1,880 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/worklio.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-09 ## Overview **Grade E · 38.6/100 · rank #812 of 842 · #10 in Payroll infrastructure · not agent-ready · confidence medium** ## Assessment Worklio documents 853 REST operations with an OpenAPI fragment on every reference page, and a developer can register for the sandbox without a sales call. No rate limits or public SDK were found, the status page is password protected, and the payroll guide tells callers to treat an HTTP 500 as the signal to finalise. ## Facts | Field | Value | | --- | --- | | Vendor | Worklio, Inc. (https://www.worklio.com) | | Kind | HTTP API | | Category | Payroll infrastructure (https://www.anchorterminal.com/categories/payroll) | | Transport | HTTP | | Endpoint | `https://api.worklio.com` | | Auth | OAuth · Every call takes a bearer JWT from `POST https://api.worklio.com/connect/token`. In the sandbox a developer registers at apiweb.worklio.com/RegisterDeveloper and uses the password grant with the account's username and password, scope `api`, and a client secret the docs print and describe as shared by all sandbox users. Tokens last 24 hours. Browser apps use an OpenID Connect redirect flow through `@worklio/sdk`, which isn't published and is requested from support. Production credentials, single sign-on and allowed origins are set up by Worklio. A System user has full rights over every company it created. This is embedded-payroll partner access, with no route into an employer's payroll account elsewhere. | | Pricing | Paid (Paid) · A partner's price is set in its agreement and isn't public. The partner pages publish retail list prices per person per month ($10 for Full-Service Payroll, $81 for all 19 modules) and call them illustrative, not a quote, with base, setup and per-use fees excluded. The sandbox is self-serve after developer registration, so an agent's owner can start without a contract. Whether registration asks for a card was not read, because apiweb.worklio.com disallows crawlers (checked 2026-10-09). | | x402 | No · No x402, MPP or L402 in the docs index, the reference pages read or the website (checked 2026-10-09). | | Licence | Proprietary service. The public Terms of Use date from 2014 and the partner agreement isn't public. The front-end library sits in a private repository | | Docs | https://apidocs.worklio.com/docs/overview | | llms.txt | https://apidocs.worklio.com/llms.txt | | Last release | 2026-06-30 | | Access graded | Embedded-payroll partner access through the REST API. A platform, PEO or payroll bureau runs payroll for its own client companies. No connector into an employer's payroll account at another provider | | API | REST at https://api.worklio.com, `/wep/...` paths with an `api-version` header (2.0 in the reference) and `/api/public/...` paths for v1.0 list endpoints. 853 operations in 17 groups, among them Company, Employee, Payroll, Reports, Benefits Deductions, Time Attendance, W4 Requests and Client General Ledger | | Payroll run | `POST /wep/companies/{companyId}/payroll` starts the default run, `.../payroll/{runId}/next` advances it, `.../finalize` finalises a locked run. Previous-step and discard calls roll a run back, and a locked run can't be discarded after its deadline | | Credentials | OAuth 2.0 bearer JWT from `POST /connect/token`. Password grant for a System user (scope `api`, 24 hours), or an OpenID Connect browser flow for Admin and Employee users through the unpublished `@worklio/sdk` | | User levels | System (all companies it created, suited to machine-to-machine use), Admin and ClientAdmin (one company), Employee (own data only) | | Rate limits | None found in the reviewed documentation | | Paging and filters | `limit`, `skip`, `filter` and `sort` as query parameters or `x-api-*` headers on `/api/public` endpoints, with a `DataToken` that expires after 60 seconds. Most `/wep` endpoints return everything | | Errors | One JSON envelope with `status`, `code`, `errorCode`, `message` and per-field `validationErrors`. The reference pages sampled document only the 200 response | | Webhooks | Company-level or system-wide, filtered by category (all, payroll, employee, client). HMAC-SHA256 signature in `WEP-Sign`. Payroll events are `Started`, `OnTimeSheet`, `Calculated`, `Approved`, `Locked` and `Finalized` | | SDKs | None public. `@worklio/sdk`, `@worklio/wep`, `@worklio/wep-vue` and `@worklio/wep-react` are not on npm, and the docs send developers to support for access to a private GitHub repository | | Sandbox | Self-serve developer registration at apiweb.worklio.com/RegisterDeveloper, then a dashboard of test companies. Production credentials and single sign-on are set up by Worklio | | Certifications | SOC 2 Type 2, ISO/IEC 27001:2013, ISO/IEC 27018:2019 and ISO 9001:2015 claimed on the security page. Hosted on Microsoft Azure in the United States | | Capabilities | payroll.run, payroll.embedded, payroll.employees, payroll.tax-filing, payroll.contractors | | Tags | hosted, closed-source, oauth, openapi, llms-txt, webhooks, sandbox, partner-access, soc2, iso27001 | | JSON | https://www.anchorterminal.com/api/v1/tools/worklio.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-09 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 25 | 5.0 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 71 | 11.5 | | Agent ergonomics | 13% | 16.2 | 44 | 7.2 | | Security & auth | 14% | 17.5 | 48 | 8.4 | | Payments & pricing | 10% | 12.5 | 25 | 3.1 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 25 | 2.2 | | Transparency & trust (editorial 28, provenance 67) | 7% | 8.8 | 48 | 4.2 | | Negative events | up to −15 | up to −15 | 30 June 2026. The changelog entry that announces the reworked Time-Off Requests API says the older `timeoffrequests` routes were replaced by hyphenated routes and tells integrators to update, in the same note and with no earlier notice found. Whether partners were told privately is unknown, so the smallest deduction applies (-3). https://apidocs.worklio.com/changelog/v1-api-updates | -3 | | **Total** | | | | **38.6 → E** | ### Why each score - Reliability 25: Read with the hosted rubric, for embedded-payroll partner access. status.worklio.com exists and asks for a password, so there is no public status page (0) and no readable incident history (5). No rate limits were found in the docs index or the guides read (0). No 429 or backoff guidance and no idempotency keys. The reference says starting a scheduled payroll twice returns the same run, and that bonus, off-cycle, void and termination starts are not idempotent (5 of 15). The security page says the Service Level Agreement targets 99.9 per cent availability, with no SLA document or credits published (5 of 10). The API is in production use and not marked beta (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 71: Each of the 853 reference pages embeds an OpenAPI 3.0.4 fragment with schemas and the bearer scheme. No single downloadable spec was found (20 of 25). llms.txt and a Markdown copy of every page (10). 821 of 853 operations carry a description, and many state which user levels may call them and in which run state (14 of 20). Inputs are typed with formats and required flags. Enums are integers whose meanings sit in description text (10 of 15). The quick-start guides give curl, Node.js and Python examples with 400 responses, while the two reference pages sampled document only a 200 (7 of 15). An `api-version` header and a changelog with two entries, both dated 30 June 2026 (10 of 15). - Agent ergonomics 44: No field selection, and the pagination guide says most `/wep` endpoints return their full result set on every call (8 of 25). The `/api/public` endpoints take `limit`, `skip`, a filter language with 18 single-field operators and multi-field sorting, with a page token that expires after 60 seconds (12 of 20). Errors share one envelope with a code and per-field validation errors, but the Run Payroll guide tells callers to read an HTTP 500 with an untranslated message as the cue to finalise, and `errorCode` is null in that example (9 of 20). No idempotency keys. Scheduled payroll starts are idempotent, runs can step back or be discarded, and updates use JSON Merge Patch (9 of 20). Creating a company needs four fields and an employee five. No public SDK (6 of 15). - Security & auth 48: Bearer JWTs with one scope, `api`, lasting 24 hours. The sandbox uses the password grant with a client secret printed in the docs and shared by all sandbox users, and the browser flow uses `response_type` `id_token token`. Production credentials are issued by Worklio, and no rotation or revocation procedure was found (14 of 30). Four user levels are enforced per operation and an Employee sees only its own data. No read-only role was found. A run must be locked and finalised in separate calls (11 of 20). Responses carry text entered by employers and workers, with no injection guidance, and the employee create response echoes the full Social Security number (3 of 15). The security page says changes by administrators, employees and clients are logged in an audit trail. No general audit endpoint was found in the index (8 of 15). SOC 2 Type 2, ISO 27001, ISO 27018 and ISO 9001 are claimed, with outside penetration testing. No security.txt, disclosure policy or bug bounty (12 of 20). - Payments & pricing 25: Read with the hosted rubric. No x402, MPP or L402 (0). Retail list prices per person per month are public, $10 for Full-Service Payroll, and the page says they are not a quote and that the partner's rate card sits in its agreement (10 of 20). The sandbox is open to any registered developer per the docs. The registration page was not read because its host disallows crawlers, so the card question is open (15 of 20). A person registers in a browser (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 25: The last dated API change is the pair of changelog entries of 30 June 2026, 101 days before the check (10 of 30). No changelog entry falls in the last 90 days. The docs sitemap shows 25 pages updated between 3 September and 8 October 2026, which we counted as half (10 of 20). A closed service with a help centre and a contact form, no public issue tracker or community (5 of 15). No public SDK or package (0 of 15, 0 of 10). - Transparency & trust 48: Closed service. The only public terms are Terms of Use last updated 21 December 2014, written for a small-business HR site and limited to personal, non-commercial use. The partner agreement isn't public (8 of 30). The privacy policy is hosted on iubenda at a path its robots.txt disallows, so it was not read. The security page gives seven days of nightly backups, 35 days of point-in-time restore and storage in the United States. No DPA was found (8 of 30). The changelog notes replaced routes and a retired preview API, and the docs mark the v1 embedded screens as legacy with a migration guide. No removal dates or policy (5 of 20). Microsoft Azure and United States locations are named, and the docs mention Plaid and Middesk. No subprocessor list (7 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (22 items): https://www.anchorterminal.com/fixes/worklio.md (JSON https://www.anchorterminal.com/fixes/worklio.json) ### What we couldn't check - unchecked: the privacy policy. It is hosted at www.iubenda.com/privacy-policy/25719508, a path iubenda's robots.txt disallows - unchecked: the developer registration page and sandbox dashboard at apiweb.worklio.com, whose robots.txt disallows every path. Whether registration needs a card or approval is not known - unchecked: the help centre at support.worklio.com, which was not read - Whether a single OpenAPI file can be downloaded. Only per-page fragments were seen - Whether the old time-off request routes stopped answering on 30 June 2026 and whether partners had earlier notice - Rate limits and whether 429 responses carry Retry-After. Nothing was found, and we had no token - Partner prices, the partner agreement, the SLA text and any DPA or subprocessor list - How production client credentials are issued, rotated and revoked - The scope and dates of the SOC 2 and ISO certificates named on the security page - The legal entity's address and state of incorporation. The footer says Worklio, Inc. and the about page says Worklio LLC was established in 2017 ### Sources - docs index with every guide and reference page: (seen 2026-10-09) - product overview: (seen 2026-10-09) - sandbox registration, token endpoint and grants: (seen 2026-10-09) - access modes: (seen 2026-10-09) - user levels: (seen 2026-10-09) - payroll run sequence and the 500 response: (seen 2026-10-09) - pagination, filtering and sorting: (seen 2026-10-09) - webhook registration and signing: (seen 2026-10-09) - webhook event types: (seen 2026-10-09) - company and employee creation guides: (seen 2026-10-09) - front-end library and private repository: (seen 2026-10-09) - reference page with OpenAPI fragment: (seen 2026-10-09) - changelog, v1: (seen 2026-10-09) - changelog, v2: (seen 2026-10-09) - docs sitemap with page update dates: (seen 2026-10-09) - security page: (seen 2026-10-09) - retail list prices: (seen 2026-10-09) - embedded payroll page: (seen 2026-10-09) - Terms of Use: (seen 2026-10-09) - privacy page: (seen 2026-10-09) - about page: (seen 2026-10-09) - status page, password protected: (seen 2026-10-09) - domain registration: (seen 2026-10-09) ## Who's behind it (provenance 67/100, checked 2026-10-09) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Worklio, Inc. | 20/20 | | Domain age | worklio.com, registered 2015-03-10 (11 years) | 15/15 | | Endpoint on the vendor's domain | api.worklio.com | 15/15 | | Terms of service | not found | 0/10 | | Privacy policy | published, but our reader couldn't read it | 7/10 | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | not found | 0/10 | The site footer reads "© 2026 Worklio, Inc.". The about page says Worklio LLC was established in 2017. No postal address was found on the pages read. No terms link is given. The only public terms are the Terms of Use at www.worklio.com/terms, last updated 21 December 2014, which describe an HR site for small businesses and predate the embedded API. The partner agreement that governs API use isn't public. www.worklio.com/privacy embeds a policy hosted at www.iubenda.com/privacy-policy/25719508. iubenda's robots.txt disallows that path, so the policy text was not read. status.worklio.com exists (an UptimeRobot page) and answers "This status page is password protected", so it is not recorded as a public status page. www.worklio.com/.well-known/security.txt returns 404. The changelog holds two entries, both dated 30 June 2026. RDAP for worklio.com gives a registration date of 2015-03-10. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0. **Privacy policy** (https://www.worklio.com/privacy), read 2026-10-08. Our reader couldn't read it (the page has only its navigation and a footer without a browser, so the policy is drawn by script or sits elsewhere). ## Live (updated 2026-10-09 09:27 UTC) - Right now: up, HTTP 403, 504 ms, checked 2026-10-09 09:27 UTC (get on `https://api.worklio.com`, asks for auth) - Uptime 24h 100.0% (20 probes) · 30 days 100.0% (20 probes) · p50 468 ms · p95 504 ms - Always current: https://www.anchorterminal.com/api/v1/live/worklio.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - 853 documented operations across 17 API groups, each reference page carrying an OpenAPI 3.0.4 fragment, plus llms.txt and a Markdown copy of every docs page - Sandbox access is self-serve. A developer registers, uses a shared sandbox client secret printed in the docs and gets a bearer token - A payroll run moves through steps with next, previous, discard, lock and finalise calls, and starting a scheduled run twice returns the same run - Every operation states which user levels may call it (System, Admin, ClientAdmin, Employee, or anonymous with a link token) - The security page claims SOC 2 Type 2, ISO 27001, ISO 27018 and ISO 9001, with third-party penetration testing ## Weaknesses - No rate limits, 429 handling or idempotency keys were found in the reviewed documentation - status.worklio.com asks for a password, so no public incident history exists - The Run Payroll guide says the `next` call answers HTTP 500 with an untranslated message when a run is ready to finalise - No public SDK. `@worklio/sdk` and the component library sit in a private repository granted through support - The public Terms of Use are dated 21 December 2014 and describe a small-business HR site. The partner agreement and production prices aren't public ## Before you call it (notes for agents) 1. Send `api-version: 2.0` on `/wep` calls. The reference marks the header as required 2. Get a token from `POST https://api.worklio.com/connect/token` with the password grant and scope `api`. It lasts 24 hours, so fetch a new one daily 3. Run payroll as start, `next` until it answers 500 with "Next step operation is not allowed", then `finalize`. Don't treat that 500 as a failure 4. Don't retry bonus, off-cycle, void or termination payroll starts blindly. The reference says those calls are not idempotent 5. Most `/wep` list endpoints return the whole result set. Paging, `filter` and `sort` work only under `/api/public`, and a `DataToken` expires after 60 seconds ## Connect First request: ```bash curl -s -X POST "https://api.worklio.com/connect/token" \ -H "accept: application/json" \ -H "content-type: application/x-www-form-urlencoded" \ --data-urlencode "grant_type=password" \ --data-urlencode "username=$WORKLIO_USERNAME" \ --data-urlencode "password=$WORKLIO_PASSWORD" \ --data-urlencode "scope=api" \ --data-urlencode "client_id=wep_resourceowner.public.api" \ --data-urlencode "client_secret=$WORKLIO_CLIENT_SECRET" ``` Through letme (picks today, calling later): https://letme.dev/worklio. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Check | B | 67.5 | 233 | payroll.run, payroll.employees, payroll.embedded, payroll.tax-filing, payroll.contractors | no | https://www.anchorterminal.com/tools/check-payroll.md | | Gusto | B | 63.3 | 362 | payroll.run, payroll.employees, payroll.embedded, payroll.tax-filing, payroll.contractors | no | https://www.anchorterminal.com/tools/gusto.md | | Everee | C | 55.1 | 600 | payroll.run, payroll.embedded, payroll.employees, payroll.contractors, payroll.tax-filing | no | https://www.anchorterminal.com/tools/everee.md | | Employment Hero Payroll | D | 50.4 | 685 | payroll.run, payroll.employees, payroll.embedded, payroll.tax-filing, payroll.contractors | no | https://www.anchorterminal.com/tools/employment-hero.md | | Salsa | D | 46.1 | 761 | payroll.run, payroll.embedded, payroll.employees, payroll.tax-filing, payroll.contractors | no | https://www.anchorterminal.com/tools/salsa.md | | Zeal | E | 45.4 | 768 | payroll.run, payroll.embedded, payroll.employees, payroll.contractors, payroll.tax-filing | no | https://www.anchorterminal.com/tools/zeal.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The docs index lists 853 operations (422 GET, 255 POST, 71 PUT, 59 DELETE, 46 PATCH) in 17 groups, and each reference page embeds an OpenAPI 3.0.4 fragment (source: ) - Sandbox access starts with developer registration at apiweb.worklio.com, and the docs print a shared sandbox client secret for the password grant. Tokens last 24 hours (source: ) - The Run Payroll guide documents an HTTP 500 with the message a missing translation key as the normal signal that a run has no more steps and should be finalised (source: ) - Paging, filtering and sorting apply to the v1.0 `/api/public` endpoints. The guide says most `/wep` endpoints return their full result set on every call (source: ) - Webhooks are signed with HMAC-SHA256 in a `WEP-Sign` header. All webhooks of one company share a key, and resetting it means deleting every registration (source: ) - The changelog has two entries, both dated 30 June 2026. One says the older time-off request routes were replaced by hyphenated routes (source: ) - A partner page publishes retail list prices per person per month, with Full-Service Payroll at $10, and says the partner's own rate card sits in its agreement (source: ) - status.worklio.com answers with "This status page is password protected" (source: ) ## Compare - [Argyle vs Worklio](https://www.anchorterminal.com/compare/argyle-vs-worklio.md): B 63.7 vs E 38.6 - [Finch vs Worklio](https://www.anchorterminal.com/compare/finch-vs-worklio.md): BB 71.6 vs E 38.6 - [Paychex vs Worklio](https://www.anchorterminal.com/compare/paychex-vs-worklio.md): E 44.8 vs E 38.6 - [Check vs Worklio](https://www.anchorterminal.com/compare/check-payroll-vs-worklio.md): B 67.5 vs E 38.6 - [Employment Hero Payroll vs Worklio](https://www.anchorterminal.com/compare/employment-hero-vs-worklio.md): D 50.4 vs E 38.6 - [Everee vs Worklio](https://www.anchorterminal.com/compare/everee-vs-worklio.md): C 55.1 vs E 38.6 - [Gusto vs Worklio](https://www.anchorterminal.com/compare/gusto-vs-worklio.md): B 63.3 vs E 38.6 - [Salsa vs Worklio](https://www.anchorterminal.com/compare/salsa-vs-worklio.md): D 46.1 vs E 38.6 - [Worklio vs Zeal](https://www.anchorterminal.com/compare/worklio-vs-zeal.md): E 38.6 vs E 45.4 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on worklio.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "worklio", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html Worklio on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![Worklio on Anchor Terminal](https://www.anchorterminal.com/badges/worklio.svg)](https://www.anchorterminal.com/tools/worklio) ``` Plain link: ```html Worklio on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Worklio is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/worklio-dark.png - Light: https://www.anchorterminal.com/assets/share/worklio-light.png