How biometric punches become attendance in Frappe HR
If your biometric or RFID devices already record punches but attendance and payroll still depend on someone copying times into spreadsheets, the gap sits between the device and Frappe HR. Every raw punch lands in Frappe HR as an *Employee Checkin* record, a single timestamped in or out event tied to an employee. These records are the evidence layer. They are not yet attendance, and nothing in payroll reads them directly. Before you commit to an integration, confirm that each device can identify the employee with a value that matches the Attendance Device ID field on the Employee record, because a punch that cannot be matched to an employee cannot be turned into attendance.
Attendance is produced by Auto Attendance, which reads check-in records within a window, pairs the first in and last out for each employee on each day, and compares the result against the employee's assigned shift. The shift defines the start time, end time and the grace and late-entry rules, so the same punches can produce different statuses under different shifts. This is why shift assignments need to be correct before the first sync, and why the shift design work is covered separately. Confirm with your HR team which rules decide present, half day and absent, and test them on a few weeks of real punches before go-live.
A device integration is worth the effort when punches arrive daily, when several sites or devices feed one employee population, or when overtime and late-entry rules depend on exact times. Manual import is a reasonable choice for a small team with one device, a short pilot, or a historic backfill, and the import route is described in the next section. The decision turns on volume, how often attendance must be current for payroll, and who will own the mapping when a card is reissued or an employee changes device ID. Ask your device vendor and your Frappe partner to confirm which push or pull method your model supports, and check it against the Frappe HR documentation before you commit.
Choosing between CSV import and the check-in API
This table compares three ways to get punch logs from a biometric device into Frappe HR: CSV import, the check-in API, and a hybrid. Read each column against your own device estate and HR team, then check the row on error handling first. The main takeaway is that CSV import suits small, infrequent loads, while automated intake needs an owner who watches for failed records.
| Factor | CSV import of punch logs | Check-in API fed by a device or middleware | Hybrid (API with CSV backfill) |
|---|---|---|---|
| Who maintains it | HR or payroll staff export logs and run the import each cycle | IT or the integration team owns the device connector, service account and monitoring | Integration team owns the live feed, HR owns the backfill procedure |
| How often data moves | Batch, on the schedule people run it, so gaps appear between loads | Near real time as punches occur, provided the connector stays online | Real time for normal days, batch for gaps caused by outages |
| Volume per import | Data Import is documented for importing only a few thousand records at a time, so split large exports into chunks | No batch ceiling in the import tool, but the middleware must handle bursts from many devices | Backfill runs stay small because most punches arrive live |
| Error handling | Failed rows appear in the import result, so staff must correct the file and re-run it | Rejected punches need a log, a retry rule and an alert, which you must design yourself | Live errors go to the integration team, backfill errors go to HR |
| Duplicate risk | Re-importing an overlapping file can create duplicate punches unless the file is de-duplicated first | Retries from middleware can duplicate punches unless the integration sends a stable identifier | Overlap windows must be agreed so the same punch is not written twice |
| Fits best | Small workforces, one site, or a pilot before any automation is approved | Multi-site or shift-heavy workforces where attendance must update during the day | Organizations that want live data but need a clean recovery path for outages |
| Confirm before choosing | Your device export format and whether it matches the import template | The check-in API contract and authentication method in your Frappe HR version | Who signs off on backfill files and how overlapping windows are measured |
Setting up Attendance Device IDs and Employee Checkin
This sequence links each device user to the right employee, confirms how punches arrive and how they are timestamped, and proves the resulting Employee Checkin records before Auto Attendance turns them into daily attendance. Each step ends with a check that the data is correct before the next one starts.
Export the device user list and agree the mapping key
The HR administrator exports the user list from each biometric or RFID device, or from the vendor's management software, and compares it with the employee roster. Choose one stable key, usually the employee ID or payroll number, and record the device's user identifier next to it. Confirm with the device vendor whether the ID is a number, a card number or a text value, because leading zeros and card formats are a common source of mismatches. Done means every active employee has exactly one device user ID, and every device ID you cannot match is listed for review.
Set Attendance Device IDs on employee records
In Frappe HR, open each Employee record and enter the value in the Attendance Device ID field, following the mapping agreed in the previous step. Bulk updates can be done with the Data Import tool, which supports updating existing records from a CSV or Excel file, but the documentation advises importing only a few thousand records at a time, so batch large rosters. Check the result with a report or list view filtered on blank Attendance Device IDs for active staff. Done means no active employee is missing an ID and no two employees share one.
Confirm log type, device time zone and timestamp format
Decide how each device reports direction: some send an explicit in or out flag, others rely on alternating punches, and some use a function key that the vendor documents. Confirm the device clock time zone and whether it is set to daylight saving time, since an offset of even one hour can move punches onto the wrong attendance date. Ask the vendor for a sample export that shows the exact timestamp format. Done means you have a written note of the direction method, the time zone and a sample line from the device that you can compare against later.
Load or send test punches for known people
Choose two or three test employees and record a known sequence of punches on the device, such as a morning in and a midday out at a time you can write down. Then bring those punches into the system, either by importing the device export into Employee Checkin or by sending them through the check-in API from a test environment. Use a test site or a non-production bench so that stray records do not reach payroll. Done means the test punches have arrived with the expected count and no errors in the import or API response log.
Verify Employee Checkin records against the test punches
Open the Employee Checkin list and check each test punch line by line. The employee on the record should be the person who punched, the time should match what you wrote down, and the log type should match the direction you confirmed. Also check that the record is linked to the right employee and not to a blank or duplicate record. If a punch is wrong, fix the device ID mapping or time zone setting, then reload the test set rather than editing records by hand. Done means every test punch matches on employee, date, time and direction.
Set up shift assignment for Auto Attendance
Auto Attendance works from shift definitions, so confirm that each test employee has a shift assignment that matches the shift they actually worked in the test window. Review the shift type's start, end and grace settings, and check whether the shift is set to process attendance from check-ins, since those settings decide which punches count as the start and end of the day. Do this with the operations or payroll owner who approves shift rosters. Done means each test employee maps to one active shift for the test dates.
Run Auto Attendance for a test shift and reconcile
Run the Auto Attendance process for the shift and date range covered by your test punches. Open the resulting Attendance records and compare each one with the Employee Checkin entries and your written test sequence. Confirm that the check-in and check-out times, the working hours and the attendance status are right, and that punches outside the shift window were not counted. Repeat with a small group of real staff in a read-only review before turning on the schedule. Done means the attendance records reconcile with the test punches, and the owner signs off on the shift and time zone settings.
How Auto Attendance uses shifts and check-ins
Auto Attendance is only as accurate as the shift assignment behind it. In Frappe HR, the Shift Type defines the start time, end time and the grace and tolerance settings that decide which punches count as on time, late or early. The Shift Assignment then ties that shift to an employee for a date range. Before you trust the output, confirm that every biometric user maps to an employee with a current, submitted Shift Assignment for each working day, and that the Shift Type's Determine Check-in and Check-out setting matches how your staff actually punch. Overnight and rotating patterns are where the window logic is most likely to misfire, so these need explicit test cases rather than a single sample day.
Auto Attendance groups the Employee Checkin records that fall inside each shift window and derives the attendance from the first IN and last OUT punch. Missing punches are the most common exception. If an employee has only an IN, or only an OUT, the record cannot produce a complete day, so decide in advance whether those days are left for manual review or marked from a fallback rule, and confirm how your version of Frappe HR handles a single punch. Multiple punches inside one shift are normal for breaks, and the calculation depends on which punches the shift treats as the boundary. Late corrections need a separate check: a manually added or edited Employee Checkin after the attendance run may not be picked up until the attendance is recalculated, so agree who approves corrections and when the calculation runs before payroll is locked.
Test with your own shift patterns before go-live, not with a generic demo. Build a short list of cases: a standard day shift, a night shift that crosses midnight, a rotating roster, an employee with two punches in one shift, a day with a forgotten punch, and a correction entered two days late. For each case, record the expected attendance status and hours, run Auto Attendance, and compare the result. Confirm these details with your Frappe HR version's documentation, since the exact handling of single punches and overnight windows has changed across releases. Keep the test results with your change records, because a payroll dispute usually starts with a disputed attendance day.
Securing device data and the integration endpoint
Punch logs are personal data, and the path from a device to Employee Checkin crosses a network, a credential and a permission model. The cards below take each exposure in turn and tie it to a control you can set inside Frappe HR and ERPNext. Confirm handling rules for biometric data with your legal and privacy staff before any template is finalized.
Protect device credentials and API keys
Each integration that pushes punches needs an API key and secret tied to a dedicated ERPNext user, not a personal or administrator account. Store the secret in the device middleware or gateway, never in a shared spreadsheet or a script kept in version control. Check which user the key belongs to, what roles that user holds, and how the key is rotated when a device is replaced or a contractor leaves.
Prevent unauthorized punch injection
An endpoint that accepts check-ins can be called by anything that can reach it, so restrict the network path first. Allow only the device gateway's addresses to reach the check-in API, terminate TLS in front of Frappe, and reject requests without the expected credentials. Test with a forged punch from an unlisted host to confirm it is refused and logged.
Limit personal data in device records
Employee Checkin records hold identifiers, timestamps, locations and device fields that tie a person to a place and time. Decide which fields the integration must write and which the device can keep locally. Avoid copying raw biometric templates into ERPNext, and confirm with privacy staff whether the device vendor stores templates on its own hardware.
Map Employee Checkin access by role
Attendance and punch data should be visible to HR administrators and the employee's own manager, not to every user with a Desk login. Use role permissions on Employee Checkin and restrict user permissions by company or branch where you run several entities. Review the permission report after each role change, and confirm that the integration user has write access only to Employee Checkin.
Audit device and import activity
Keep a record of which device or file produced each punch, who ran a CSV import, and which records were changed afterward. Use the Device ID field on each log to trace punches back to hardware, and keep import files under the same access rules as payroll data. Ask your team to confirm how long these logs are kept and who may read them.
Keep server scripts and hooks disabled
Custom logic that validates or rewrites punches can be written as Server Scripts, which run Python on document events. Starting from version 15 they are disabled by default and must be enabled with server_script_enabled. Enable them only on a self-hosted site where you control the code, review each script like application code, and do not rely on them on shared public hosting.
Questions buyers ask before hiring help with device integration
What drives the cost of a biometric attendance integration?
The cost follows the scope written into the quote, and four factors move it most: the number of devices, the vendor SDK or protocol each device uses, the number of sites, and how much testing is needed before go-live. A single device exposing a documented export is a small job. Several device models, each with its own push or pull method, across multiple branches with different shift rules, is a larger one. The integration itself is a one-time cost. Ongoing support, device firmware changes and new hardware are recurring and should be priced separately. Ask the partner to itemize device discovery, integration build, shift and auto attendance configuration, testing and handover, and to state which items are fixed and which depend on device count.
How long does it take to see the first live punches in Frappe HR?
The first live punches depend less on the Frappe HR setup than on access to the devices and the network path to them. Once a device can reach the server and its logs can be read or pushed, a test employee punch should appear as an Employee Checkin record. Delays usually come from waiting for device administrator access, firewall changes, confirming that Attendance Device IDs match the employee master, or agreeing on the source of truth for shift times. Ask for a written plan that lists these dependencies as milestones, names the person who owns each one on your side, and identifies the first device to go live as a pilot before the remaining sites.
What must our team provide before the integration work starts?
Most delays trace back to inputs that were not ready. Prepare the following before work begins:
- Administrative access to each device, or its vendor management console, and the model and firmware version of each unit
- Network details: device IP addresses, ports, VLAN or subnet layout, and whether the devices can reach the Frappe HR server or must be polled from it
- Written shift rules, including grace periods, rounding, night shifts and overtime thresholds
- A clean employee master with employee IDs, Attendance Device IDs and active status
- A named approver for attendance corrections and a test window for pilot punches
State these as client responsibilities in the written scope so that a late input shows up as a schedule change rather than a defect.
Can our internal team integrate biometric devices with Frappe HR on its own?
A team with Frappe administration experience and access to the devices can often complete a simple integration alone, particularly if the device offers a documented export and a single site is involved. The skills that are harder to build internally are the vendor-specific protocol or SDK work, the handling of duplicate or out-of-order punches, the reconciliation between raw logs and Attendance records, and the testing across shift patterns. Ask yourself whether the people who will maintain the integration after go-live will be the same people who built it, and whether they have time to repeat the test cycle after each Frappe HR or firmware upgrade. A fixed-scope engagement can cover the build and handover while your team keeps ownership.
Should we use a CSV import or the check-in API for punch logs?
A CSV import suits a one-off backfill or a device that only exports files, while the check-in API suits continuous punches from devices or middleware. The import path depends on the Data Import tool, which the ERPNext documentation advises using for only a few thousand records at a time, so large historical files need batching. The API path needs an authenticated caller, a mapping from device user IDs to employees, and a retry strategy for failed posts. Many sites use both: a historical import to backfill, then the live API for new punches. Ask the partner to justify the choice for each device model in writing.
How much ongoing support does a device integration need?
Support recurs because devices, firmware, networks and Frappe HR versions keep changing. Expect recurring work on monitoring of the sync job, handling of new employees and device IDs, firmware or device replacement, and retesting after each ERPNext or Frappe HR upgrade. Frappe publishes supported versions, and only listed versions are covered for warranty by Frappe, so plan upgrade testing against the version you run. Ask for the support scope, response expectations and whether retainers cover device changes or only the integration code.
What security and data protection points should we check?
Biometric data is sensitive, and the integration should avoid storing templates in Frappe HR unless your legal basis and policy allow it. Punch logs usually need only employee identifiers and timestamps. Confirm which device data leaves the device, how it travels over the network, which service account posts to the API, and who can view Employee Checkin records. Restrict Server Script use if the integration relies on one, since Frappe disables Server Scripts by default from version 15 and must have them enabled, and public shared benches do not allow them. Ask the partner to document these decisions and to confirm them with your privacy and security teams before the pilot.
What to confirm with your device vendor and environment
Biometric integration depends on three parties: the device, the Frappe HR version, and the hosting model. Each card below is a fact to confirm early, because an assumption in any one of them can change the integration method you choose and the work it takes.
Log export format from the device
Confirm that your exact device model can export punch logs in a format you can parse, such as a file export, a database table, or a network push. Ask the vendor for a sample export with real punches, including the column order, the date and time format, and how the employee identifier is written. Models sold under the same brand often differ, so check the firmware version and the model number, not the product line.
Device clock and time sync
Ask how the device keeps time and whether it syncs to an NTP server. A device that drifts or stores local time without a time zone can shift punches across midnight and break shift-based attendance. Confirm whether the export uses UTC or local time, and whether the device changes its clock for daylight saving time automatically.
Supported punch types
Check which punch types the device records, such as check-in, check-out, break-out, break-in, and overtime-in. Frappe HR needs to know how each punch maps to a log type. If the device sends only an unlabelled stream of punches, plan how the first and last punch of a shift will be interpreted before you rely on Auto Attendance.
Frappe HR version in use
Confirm which Frappe HR and ERPNext versions you run, then check that version's support status before you plan the work. Field names, import behavior and the check-in API can change between major versions, so test against your own version rather than documentation written for another release.
Server Scripts and hosting model
Server Scripts are disabled by default from version 15 and must be enabled with the server_script_enabled setting. Frappe Cloud public shared benches do not allow them. If your integration depends on a server script that calls a device endpoint or transforms punches, confirm that your plan is self-hosted or a bench that permits it, or move that logic into a custom app.
Network path and integration method
Decide whether the device can reach Frappe HR directly or whether files must be moved by an operator, and confirm that the chosen method, CSV import or the check-in API, is allowed by your deployment and network policy. Devices on a plant network often cannot reach a cloud-hosted site, so a relay host inside your network may be needed.
What you provide and what DeployOpen delivers
Before any work starts, the client supplies the inputs that decide whether punch logs can be matched to the right people. The most important is an inventory of every biometric or RFID device: vendor, model, firmware version, location, and whether it is cloud-managed or on the local network. Next comes the employee ID mapping, which lists each device user ID alongside the ERPNext Employee record it belongs to, so that the Attendance Device ID field on each Employee is filled from a list someone in HR has checked. Shift schedules should also be provided in writing, including rotations, night shifts that cross midnight and any grace periods, because Auto Attendance depends on them. Finally, the client names an HR data owner, an IT owner for device network access and a sign-off approver, and provides a test environment that is a copy of production or a separate Frappe HR site where test punches can be imported without touching live attendance.
DeployOpen delivers the work in a scope agreed in writing before it begins. In general terms, that means a documented mapping of device users to employees and a record of how unmatched IDs are handled, a tested import or API path that creates Employee Checkin records from the device source, and verification records showing sample punches, the resulting check-ins and the attendance rows they produce. The scope also states which device models and integration routes are covered. Where a device cannot export data in the format the chosen path needs, the scope says so and names the workaround or the device change the client must approve. Each deliverable is tied to a named acceptance check, such as a reconciliation of punch counts for a test period, so the client can judge completion without relying on the implementation team's word.
The handover includes a runbook that the HR and IT owners can use after go-live. It covers how new employees are added to the device and mapped in ERPNext, how a failed import or dropped API call is detected and retried, who reviews unmatched punches, and how device time zones and clock drift are checked. Pricing and duration follow from the written scope, so the client should ask for each device route, the number of devices and sites, and the test cycles to be itemized. Ongoing support for device firmware changes or new hardware is a separate decision, and it can be contracted as a retainer if the client wants DeployOpen to keep the integration working between releases.
How the integration differs on Frappe Cloud and self-hosted ERPNext
Shared benches on Frappe Cloud are the most constrained option for device integration. The platform runs many customer sites on common infrastructure, so the sites you can reach are limited by what the provider allows on that tier. Frappe's Server Script documentation states that Frappe Cloud public shared benches do not allow server scripts, which removes the most flexible way to transform raw punches inside the site. Before you commit to a method, confirm the following with the provider:
- Server scripts: whether custom Python endpoints or document event hooks are permitted on your plan.
- Scheduled imports: whether you can run a recurring CSV or file import, or need to drive it from an external job that calls the site API.
- Inbound API access: whether your site accepts calls from the device gateway or middleware at the network addresses you use.
- Outbound network rules: whether the site can reach a device or a local collector on your network without a VPN or tunnel.
- Upgrade and support terms: which Frappe version your site runs and whether it is covered by a matching support plan.
If the provider blocks any of these, plan for an external collector that writes into Frappe HR through its API, or move to a dedicated bench.
A dedicated server on Frappe Cloud gives you a bench you control at the operating system level, which opens more integration options than a shared bench. Pricing for dedicated servers starts at 125 US dollars per month, according to the ERPNext pricing page, but the actual cost depends on the server size and add-ons you select, so request a quote for your configuration. The main decisions are about what you can install and how the device traffic reaches the site.
- Custom code: whether you can enable server scripts and deploy custom apps that handle device payloads.
- Scheduled jobs: whether the background scheduler and workers run the jobs you define for periodic imports.
- Network path: how devices or a local collector reach the site, including VPN, IP allowlisting or a secure tunnel.
- Backups and restores: how punch data is backed up, and whether a restore point covers the device import history.
- Responsibility split: which tasks Frappe Cloud performs and which tasks your partner or internal team performs, written into the support terms.
Ask the provider to confirm that server scripts are enabled on your plan, that the scheduler is available, and how inbound traffic from your network is permitted before you finalize the design.
Self-hosting with Docker Compose uses the production images and Compose files from the frappe_docker repository. The stack includes MariaDB, Redis, background workers, the scheduler, Socket.io and Nginx, which means the background jobs needed for scheduled device imports are part of the standard layout. The repository's single-file demo setup is marked for short-lived evaluation only, so use the production-oriented files for any environment that receives real attendance data.
- Worker and scheduler services: confirm that the worker and scheduler containers are running, since scheduled imports depend on them.
- Network reachability: place the device gateway or collector on a network segment that can reach the Nginx entry point or the Frappe API.
- Custom images: build an image that includes any custom app for device parsing, and pin the version you test.
- Secrets and API keys: store API credentials for device connectors outside the image and rotate them on a schedule your security team sets.
- Time synchronization: keep the containers and device clocks aligned, because punch timestamps drive attendance calculation.
Your team owns the host, the network rules and the update process, so check these responsibilities before choosing a method.
Installing ERPNext manually with the bench command line tool gives the most control over the Python environment, the scheduler, and the web server. The frappe/erpnext README lists bench as one of three installation paths, alongside Frappe Cloud and Docker Compose. Because you manage each process directly, you decide how workers, the scheduler and the reverse proxy run, and you also take on the work of keeping them healthy.
- Process management: run the scheduler and background workers under a supervisor so they restart after a failure or host reboot.
- Custom apps: install device connector apps with bench, and keep them in version control so each site can be rebuilt the same way.
- Server scripts: enable the server_script_enabled setting in the site configuration if you plan to use scripts, since they are disabled by default from version 15.
- Firewall and proxy rules: open only the ports the device gateway needs, and terminate TLS at the proxy.
- Upgrades: plan minor and major upgrades against the supported versions list, and test device imports after each change.
With bench, the full set of integration options is available, but the cost is operational. Confirm who will run the scheduler and patch the host before you commit to this path.
Running the attendance feed after go-live
The attendance feed needs a named owner after go-live, and that owner should be someone who will check it every working day. Once punches flow into Employee Checkin, the risk moves from installation to drift: imports fail quietly, devices get replaced, clocks wander and new hires appear without a device ID. Name one person in HR operations and one backup in IT. Give them a short written runbook that covers who fixes a failed import, who approves a device swap and who is told when an employee has no mapped Attendance Device ID. Confirm with your partner or Frappe HR documentation which import and sync logs the version you run exposes, so the owner knows where failures show up.
Reconcile Employee Checkin records against the device's own log on a fixed cadence, starting with a sample of several days after go-live and then a regular monthly check before payroll closes. Compare counts per employee and per device, and look for punches that are missing, duplicated or stamped on the wrong date. Time drift is the most common silent fault: a device clock that runs fast or slow shifts punches across shift boundaries, which then affects Auto Attendance. Check device clocks against a trusted time source at a set interval and record each correction. When a device is replaced, keep the old device's last punch timestamp, map the new device to the same location, and confirm that the Attendance Device IDs on employee records still match before the first punch arrives.
Treat the scheduler and background jobs as the first place to look when punches stop appearing, not as an area you can ignore until something breaks. Confirm that the scheduler is running on the site, that the jobs which process imports and attendance are queued and completing, and that failures alert the owner. Ask your partner which of these checks apply to your hosting model, because a Frappe Cloud site and a self-hosted bench expose them differently. Finally, build a joiner step into HR onboarding so every new employee receives an Attendance Device ID before their first shift, and add a leaver step that stops mapping them. Most missed punches in mature deployments trace back to a new hire who was never mapped.
How DeployOpen scopes and delivers biometric attendance integration
DeployOpen plans, implements, customizes, integrates, documents and supports self-hosted open-source platforms inside your own infrastructure. For biometric attendance, that means agreeing in writing which device models, punch log sources and Frappe HR settings are in scope, then building and testing the path from device to Auto Attendance before go-live.
How we scope
- Inventory every device model, firmware generation and network path that will send punch logs to Frappe HR.
- Confirm which Attendance Device IDs, Employee Checkin records and shift assignments the integration must produce.
- Agree in writing whether the feed uses CSV import, the check-in API or both, and who owns each step.
How we build
- Configure Employee Checkin and Attendance Device ID mapping against a sample of real punch records from each device type.
- Test Auto Attendance by shift, including late punches, missed punches, night shifts and employees on more than one shift.
- Set up scheduled imports or API calls with logging, so failed punches are visible and can be replayed.
How we hand over
- Deliver the written configuration, device mapping table, import templates and the test cases used for sign-off.
- Document how to add a device, rename an employee ID, and correct a bad punch without breaking attendance history.
- Walk your HR and IT operators through daily checks, reconciliation reports and the escalation path for device faults.
How we support
- Ongoing support, upgrades and testing are available as a retainer, sized to the number of devices and sites you run.
- Review Frappe HR and ERPNext releases before upgrades, since attendance and shift behavior can change between versions.
- Confirm with your device vendor which firmware, protocol and push or pull options your models support before any build starts.

