> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ontime.hosai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations

> The integrations registry — what connecting a provider does today, and what it does not.

export const PermissionNote = ({perm}) => <Info>
    Requires the <code>{perm}</code> permission. Ask your administrator if an
    action described here is missing from your screen — see
    [Roles & permissions](/help/concepts/roles-and-permissions).
  </Info>;

<PermissionNote perm="integration:write" />

**Settings → Integrations.**

<Warning>
  **Read this first.** Integrations in OnTime today are a **configuration registry**. Connecting a provider stores the configuration you enter and marks the provider connected.

  **It does not authenticate with the provider, exchange any credentials, or move any data.** There is no OAuth flow, no handshake, no validation of what you typed, and no outbound call of any kind. Connecting Tally Prime does not sync anything to Tally Prime.

  This is a deliberate boundary for this release, not a bug — but it means a green "Connected" badge indicates that configuration is recorded, and nothing more.
</Warning>

## The registry

Eight providers across five categories:

| Provider           | Category         |
| ------------------ | ---------------- |
| Sales Field Force  | Field operations |
| Tally Prime        | Accounting       |
| Zoho Books         | Accounting       |
| HDFC Payroll       | Payouts          |
| Razorpay           | Payouts          |
| WhatsApp Business  | Messaging        |
| Teams / Slack      | Messaging        |
| SAP SuccessFactors | HRIS             |

They appear in two sections — **Connected** and **Available**.

## Connecting

<Steps>
  <Step title="Choose a provider">
    From the Available list.
  </Step>

  <Step title="Fill in its configuration">
    Each provider declares its own fields. Fields marked as secrets are entered as password inputs and are masked in every subsequent response.
  </Step>

  <Step title="Connect">
    The configuration is stored and the provider moves to Connected with a timestamp.
  </Step>
</Steps>

**Disconnect** is a single click and moves it back.

Both actions are audited.

## Security note

<Warning>
  **Configuration values, including secret-flagged fields, are stored unencrypted.** They are masked when read back through the API, but the underlying storage is plaintext — there is no field-level encryption and no secrets-manager indirection.

  Do not enter real third-party credentials here. Because no outbound call is ever made, there is nothing that needs a working credential — enter placeholder values until this changes.
</Warning>

## What real integration would look like

If you need data to actually move between OnTime and another system today, the routes that work are:

<CardGroup cols={2}>
  <Card title="Public API" icon="code">
    Pull employees and attendance from your own systems on your own schedule.
  </Card>

  <Card title="Webhooks" icon="webhook">
    Receive an HMAC-signed POST when a leave request is approved, a payslip is published, and seven other events.
  </Card>
</CardGroup>

Both are documented under the **Developers** tab, and both are real, working machine interfaces — unlike this registry.