Set up a Gusto connector

​

Capabilities

• Company Admin is modeled as an entitlement on the Company resource. Granting adds a company admin; Gusto exposes no API to revoke an admin, so admin removal must be done in the Gusto UI.
• Delete employee succeeds only for employees who have not yet completed onboarding. Already-onboarded employees must be deprovisioned manually in the Gusto UI.
• Single company per credential. Each Gusto OAuth credential is bound to exactly one Gusto company.
• Production vs. demo environment. By default the connector targets Gusto production using ConductorOne’s managed OAuth app. To connect to Gusto’s demo environment (https://api.gusto-demo.com), choose Custom App (Demo Environment) during setup and provide your own Gusto developer app’s Client ID and Client Secret — Gusto requires a developer-owned app for the demo environment.

​

Gather Gusto credentials

​

Configure the Gusto connector

# baton-gusto-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-gusto-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Gusto credentials
  # Add connector-specific credentials here

# baton-gusto.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-gusto
  labels:
    app: baton-gusto
spec:
  selector:
    matchLabels:
      app: baton-gusto
  template:
    metadata:
      labels:
        app: baton-gusto
        baton: "true"
        baton-app: gusto
    spec:
      containers:
      - name: baton-gusto
        image: public.ecr.aws/conductorone/baton-gusto:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-gusto
        envFrom:
        - secretRef:
            name: baton-gusto-secrets