Integrating biometric attendance devices with Frappe HR

Punch logs from biometric or RFID devices can reach Frappe HR as Employee Checkin records, through a CSV import or an API integration. This page explains the options, the setup sequence and what to confirm before you build.

On this page

How biometric punches become attendance in Frappe HR

If your biometric or RFID devices already record punches but attendance and payroll still depend on someone copying times into spreadsheets, the gap sits between the device and Frappe HR. Every raw punch lands in Frappe HR as an *Employee Checkin* record, a single timestamped in or out event tied to an employee. These records are the evidence layer. They are not yet attendance, and nothing in payroll reads them directly. Before you commit to an integration, confirm that each device can identify the employee with a value that matches the Attendance Device ID field on the Employee record, because a punch that cannot be matched to an employee cannot be turned into attendance.

Attendance is produced by Auto Attendance, which reads check-in records within a window, pairs the first in and last out for each employee on each day, and compares the result against the employee's assigned shift. The shift defines the start time, end time and the grace and late-entry rules, so the same punches can produce different statuses under different shifts. This is why shift assignments need to be correct before the first sync, and why the shift design work is covered separately. Confirm with your HR team which rules decide present, half day and absent, and test them on a few weeks of real punches before go-live.

A device integration is worth the effort when punches arrive daily, when several sites or devices feed one employee population, or when overtime and late-entry rules depend on exact times. Manual import is a reasonable choice for a small team with one device, a short pilot, or a historic backfill, and the import route is described in the next section. The decision turns on volume, how often attendance must be current for payroll, and who will own the mapping when a card is reissued or an employee changes device ID. Ask your device vendor and your Frappe partner to confirm which push or pull method your model supports, and check it against the Frappe HR documentation before you commit.

Choosing between CSV import and the check-in API

This table compares three ways to get punch logs from a biometric device into Frappe HR: CSV import, the check-in API, and a hybrid. Read each column against your own device estate and HR team, then check the row on error handling first. The main takeaway is that CSV import suits small, infrequent loads, while automated intake needs an owner who watches for failed records.

FactorCSV import of punch logsCheck-in API fed by a device or middlewareHybrid (API with CSV backfill)
Who maintains itHR or payroll staff export logs and run the import each cycleIT or the integration team owns the device connector, service account and monitoringIntegration team owns the live feed, HR owns the backfill procedure
How often data movesBatch, on the schedule people run it, so gaps appear between loadsNear real time as punches occur, provided the connector stays onlineReal time for normal days, batch for gaps caused by outages
Volume per importData Import is documented for importing only a few thousand records at a time, so split large exports into chunksNo batch ceiling in the import tool, but the middleware must handle bursts from many devicesBackfill runs stay small because most punches arrive live
Error handlingFailed rows appear in the import result, so staff must correct the file and re-run itRejected punches need a log, a retry rule and an alert, which you must design yourselfLive errors go to the integration team, backfill errors go to HR
Duplicate riskRe-importing an overlapping file can create duplicate punches unless the file is de-duplicated firstRetries from middleware can duplicate punches unless the integration sends a stable identifierOverlap windows must be agreed so the same punch is not written twice
Fits bestSmall workforces, one site, or a pilot before any automation is approvedMulti-site or shift-heavy workforces where attendance must update during the dayOrganizations that want live data but need a clean recovery path for outages
Confirm before choosingYour device export format and whether it matches the import templateThe check-in API contract and authentication method in your Frappe HR versionWho signs off on backfill files and how overlapping windows are measured

Setting up Attendance Device IDs and Employee Checkin

This sequence links each device user to the right employee, confirms how punches arrive and how they are timestamped, and proves the resulting Employee Checkin records before Auto Attendance turns them into daily attendance. Each step ends with a check that the data is correct before the next one starts.

  1. Export the device user list and agree the mapping key

    The HR administrator exports the user list from each biometric or RFID device, or from the vendor's management software, and compares it with the employee roster. Choose one stable key, usually the employee ID or payroll number, and record the device's user identifier next to it. Confirm with the device vendor whether the ID is a number, a card number or a text value, because leading zeros and card formats are a common source of mismatches. Done means every active employee has exactly one device user ID, and every device ID you cannot match is listed for review.

  2. Set Attendance Device IDs on employee records

    In Frappe HR, open each Employee record and enter the value in the Attendance Device ID field, following the mapping agreed in the previous step. Bulk updates can be done with the Data Import tool, which supports updating existing records from a CSV or Excel file, but the documentation advises importing only a few thousand records at a time, so batch large rosters. Check the result with a report or list view filtered on blank Attendance Device IDs for active staff. Done means no active employee is missing an ID and no two employees share one.

  3. Confirm log type, device time zone and timestamp format

    Decide how each device reports direction: some send an explicit in or out flag, others rely on alternating punches, and some use a function key that the vendor documents. Confirm the device clock time zone and whether it is set to daylight saving time, since an offset of even one hour can move punches onto the wrong attendance date. Ask the vendor for a sample export that shows the exact timestamp format. Done means you have a written note of the direction method, the time zone and a sample line from the device that you can compare against later.

  4. Load or send test punches for known people

    Choose two or three test employees and record a known sequence of punches on the device, such as a morning in and a midday out at a time you can write down. Then bring those punches into the system, either by importing the device export into Employee Checkin or by sending them through the check-in API from a test environment. Use a test site or a non-production bench so that stray records do not reach payroll. Done means the test punches have arrived with the expected count and no errors in the import or API response log.

  5. Verify Employee Checkin records against the test punches

    Open the Employee Checkin list and check each test punch line by line. The employee on the record should be the person who punched, the time should match what you wrote down, and the log type should match the direction you confirmed. Also check that the record is linked to the right employee and not to a blank or duplicate record. If a punch is wrong, fix the device ID mapping or time zone setting, then reload the test set rather than editing records by hand. Done means every test punch matches on employee, date, time and direction.

  6. Set up shift assignment for Auto Attendance

    Auto Attendance works from shift definitions, so confirm that each test employee has a shift assignment that matches the shift they actually worked in the test window. Review the shift type's start, end and grace settings, and check whether the shift is set to process attendance from check-ins, since those settings decide which punches count as the start and end of the day. Do this with the operations or payroll owner who approves shift rosters. Done means each test employee maps to one active shift for the test dates.

  7. Run Auto Attendance for a test shift and reconcile

    Run the Auto Attendance process for the shift and date range covered by your test punches. Open the resulting Attendance records and compare each one with the Employee Checkin entries and your written test sequence. Confirm that the check-in and check-out times, the working hours and the attendance status are right, and that punches outside the shift window were not counted. Repeat with a small group of real staff in a read-only review before turning on the schedule. Done means the attendance records reconcile with the test punches, and the owner signs off on the shift and time zone settings.

How Auto Attendance uses shifts and check-ins

Auto Attendance is only as accurate as the shift assignment behind it. In Frappe HR, the Shift Type defines the start time, end time and the grace and tolerance settings that decide which punches count as on time, late or early. The Shift Assignment then ties that shift to an employee for a date range. Before you trust the output, confirm that every biometric user maps to an employee with a current, submitted Shift Assignment for each working day, and that the Shift Type's Determine Check-in and Check-out setting matches how your staff actually punch. Overnight and rotating patterns are where the window logic is most likely to misfire, so these need explicit test cases rather than a single sample day.

Auto Attendance groups the Employee Checkin records that fall inside each shift window and derives the attendance from the first IN and last OUT punch. Missing punches are the most common exception. If an employee has only an IN, or only an OUT, the record cannot produce a complete day, so decide in advance whether those days are left for manual review or marked from a fallback rule, and confirm how your version of Frappe HR handles a single punch. Multiple punches inside one shift are normal for breaks, and the calculation depends on which punches the shift treats as the boundary. Late corrections need a separate check: a manually added or edited Employee Checkin after the attendance run may not be picked up until the attendance is recalculated, so agree who approves corrections and when the calculation runs before payroll is locked.

Test with your own shift patterns before go-live, not with a generic demo. Build a short list of cases: a standard day shift, a night shift that crosses midnight, a rotating roster, an employee with two punches in one shift, a day with a forgotten punch, and a correction entered two days late. For each case, record the expected attendance status and hours, run Auto Attendance, and compare the result. Confirm these details with your Frappe HR version's documentation, since the exact handling of single punches and overnight windows has changed across releases. Keep the test results with your change records, because a payroll dispute usually starts with a disputed attendance day.

Securing device data and the integration endpoint

Punch logs are personal data, and the path from a device to Employee Checkin crosses a network, a credential and a permission model. The cards below take each exposure in turn and tie it to a control you can set inside Frappe HR and ERPNext. Confirm handling rules for biometric data with your legal and privacy staff before any template is finalized.

Protect device credentials and API keys

Each integration that pushes punches needs an API key and secret tied to a dedicated ERPNext user, not a personal or administrator account. Store the secret in the device middleware or gateway, never in a shared spreadsheet or a script kept in version control. Check which user the key belongs to, what roles that user holds, and how the key is rotated when a device is replaced or a contractor leaves.

Prevent unauthorized punch injection

An endpoint that accepts check-ins can be called by anything that can reach it, so restrict the network path first. Allow only the device gateway's addresses to reach the check-in API, terminate TLS in front of Frappe, and reject requests without the expected credentials. Test with a forged punch from an unlisted host to confirm it is refused and logged.

Limit personal data in device records

Employee Checkin records hold identifiers, timestamps, locations and device fields that tie a person to a place and time. Decide which fields the integration must write and which the device can keep locally. Avoid copying raw biometric templates into ERPNext, and confirm with privacy staff whether the device vendor stores templates on its own hardware.

Map Employee Checkin access by role

Attendance and punch data should be visible to HR administrators and the employee's own manager, not to every user with a Desk login. Use role permissions on Employee Checkin and restrict user permissions by company or branch where you run several entities. Review the permission report after each role change, and confirm that the integration user has write access only to Employee Checkin.

Audit device and import activity

Keep a record of which device or file produced each punch, who ran a CSV import, and which records were changed afterward. Use the Device ID field on each log to trace punches back to hardware, and keep import files under the same access rules as payroll data. Ask your team to confirm how long these logs are kept and who may read them.

Keep server scripts and hooks disabled

Custom logic that validates or rewrites punches can be written as Server Scripts, which run Python on document events. Starting from version 15 they are disabled by default and must be enabled with server_script_enabled. Enable them only on a self-hosted site where you control the code, review each script like application code, and do not rely on them on shared public hosting.

Questions buyers ask before hiring help with device integration

What drives the cost of a biometric attendance integration?

The cost follows the scope written into the quote, and four factors move it most: the number of devices, the vendor SDK or protocol each device uses, the number of sites, and how much testing is needed before go-live. A single device exposing a documented export is a small job. Several device models, each with its own push or pull method, across multiple branches with different shift rules, is a larger one. The integration itself is a one-time cost. Ongoing support, device firmware changes and new hardware are recurring and should be priced separately. Ask the partner to itemize device discovery, integration build, shift and auto attendance configuration, testing and handover, and to state which items are fixed and which depend on device count.

How long does it take to see the first live punches in Frappe HR?

The first live punches depend less on the Frappe HR setup than on access to the devices and the network path to them. Once a device can reach the server and its logs can be read or pushed, a test employee punch should appear as an Employee Checkin record. Delays usually come from waiting for device administrator access, firewall changes, confirming that Attendance Device IDs match the employee master, or agreeing on the source of truth for shift times. Ask for a written plan that lists these dependencies as milestones, names the person who owns each one on your side, and identifies the first device to go live as a pilot before the remaining sites.

What must our team provide before the integration work starts?

Most delays trace back to inputs that were not ready. Prepare the following before work begins:

  • Administrative access to each device, or its vendor management console, and the model and firmware version of each unit
  • Network details: device IP addresses, ports, VLAN or subnet layout, and whether the devices can reach the Frappe HR server or must be polled from it
  • Written shift rules, including grace periods, rounding, night shifts and overtime thresholds
  • A clean employee master with employee IDs, Attendance Device IDs and active status
  • A named approver for attendance corrections and a test window for pilot punches

State these as client responsibilities in the written scope so that a late input shows up as a schedule change rather than a defect.

Can our internal team integrate biometric devices with Frappe HR on its own?

A team with Frappe administration experience and access to the devices can often complete a simple integration alone, particularly if the device offers a documented export and a single site is involved. The skills that are harder to build internally are the vendor-specific protocol or SDK work, the handling of duplicate or out-of-order punches, the reconciliation between raw logs and Attendance records, and the testing across shift patterns. Ask yourself whether the people who will maintain the integration after go-live will be the same people who built it, and whether they have time to repeat the test cycle after each Frappe HR or firmware upgrade. A fixed-scope engagement can cover the build and handover while your team keeps ownership.

Should we use a CSV import or the check-in API for punch logs?

A CSV import suits a one-off backfill or a device that only exports files, while the check-in API suits continuous punches from devices or middleware. The import path depends on the Data Import tool, which the ERPNext documentation advises using for only a few thousand records at a time, so large historical files need batching. The API path needs an authenticated caller, a mapping from device user IDs to employees, and a retry strategy for failed posts. Many sites use both: a historical import to backfill, then the live API for new punches. Ask the partner to justify the choice for each device model in writing.

How much ongoing support does a device integration need?

Support recurs because devices, firmware, networks and Frappe HR versions keep changing. Expect recurring work on monitoring of the sync job, handling of new employees and device IDs, firmware or device replacement, and retesting after each ERPNext or Frappe HR upgrade. Frappe publishes supported versions, and only listed versions are covered for warranty by Frappe, so plan upgrade testing against the version you run. Ask for the support scope, response expectations and whether retainers cover device changes or only the integration code.

What security and data protection points should we check?

Biometric data is sensitive, and the integration should avoid storing templates in Frappe HR unless your legal basis and policy allow it. Punch logs usually need only employee identifiers and timestamps. Confirm which device data leaves the device, how it travels over the network, which service account posts to the API, and who can view Employee Checkin records. Restrict Server Script use if the integration relies on one, since Frappe disables Server Scripts by default from version 15 and must have them enabled, and public shared benches do not allow them. Ask the partner to document these decisions and to confirm them with your privacy and security teams before the pilot.

What to confirm with your device vendor and environment

Biometric integration depends on three parties: the device, the Frappe HR version, and the hosting model. Each card below is a fact to confirm early, because an assumption in any one of them can change the integration method you choose and the work it takes.

Log export format from the device

Confirm that your exact device model can export punch logs in a format you can parse, such as a file export, a database table, or a network push. Ask the vendor for a sample export with real punches, including the column order, the date and time format, and how the employee identifier is written. Models sold under the same brand often differ, so check the firmware version and the model number, not the product line.

Device clock and time sync

Ask how the device keeps time and whether it syncs to an NTP server. A device that drifts or stores local time without a time zone can shift punches across midnight and break shift-based attendance. Confirm whether the export uses UTC or local time, and whether the device changes its clock for daylight saving time automatically.

Supported punch types

Check which punch types the device records, such as check-in, check-out, break-out, break-in, and overtime-in. Frappe HR needs to know how each punch maps to a log type. If the device sends only an unlabelled stream of punches, plan how the first and last punch of a shift will be interpreted before you rely on Auto Attendance.

Frappe HR version in use

Confirm which Frappe HR and ERPNext versions you run, then check that version's support status before you plan the work. Field names, import behavior and the check-in API can change between major versions, so test against your own version rather than documentation written for another release.

Server Scripts and hosting model

Server Scripts are disabled by default from version 15 and must be enabled with the server_script_enabled setting. Frappe Cloud public shared benches do not allow them. If your integration depends on a server script that calls a device endpoint or transforms punches, confirm that your plan is self-hosted or a bench that permits it, or move that logic into a custom app.

Network path and integration method

Decide whether the device can reach Frappe HR directly or whether files must be moved by an operator, and confirm that the chosen method, CSV import or the check-in API, is allowed by your deployment and network policy. Devices on a plant network often cannot reach a cloud-hosted site, so a relay host inside your network may be needed.

What you provide and what DeployOpen delivers

Before any work starts, the client supplies the inputs that decide whether punch logs can be matched to the right people. The most important is an inventory of every biometric or RFID device: vendor, model, firmware version, location, and whether it is cloud-managed or on the local network. Next comes the employee ID mapping, which lists each device user ID alongside the ERPNext Employee record it belongs to, so that the Attendance Device ID field on each Employee is filled from a list someone in HR has checked. Shift schedules should also be provided in writing, including rotations, night shifts that cross midnight and any grace periods, because Auto Attendance depends on them. Finally, the client names an HR data owner, an IT owner for device network access and a sign-off approver, and provides a test environment that is a copy of production or a separate Frappe HR site where test punches can be imported without touching live attendance.

DeployOpen delivers the work in a scope agreed in writing before it begins. In general terms, that means a documented mapping of device users to employees and a record of how unmatched IDs are handled, a tested import or API path that creates Employee Checkin records from the device source, and verification records showing sample punches, the resulting check-ins and the attendance rows they produce. The scope also states which device models and integration routes are covered. Where a device cannot export data in the format the chosen path needs, the scope says so and names the workaround or the device change the client must approve. Each deliverable is tied to a named acceptance check, such as a reconciliation of punch counts for a test period, so the client can judge completion without relying on the implementation team's word.

The handover includes a runbook that the HR and IT owners can use after go-live. It covers how new employees are added to the device and mapped in ERPNext, how a failed import or dropped API call is detected and retried, who reviews unmatched punches, and how device time zones and clock drift are checked. Pricing and duration follow from the written scope, so the client should ask for each device route, the number of devices and sites, and the test cycles to be itemized. Ongoing support for device firmware changes or new hardware is a separate decision, and it can be contracted as a retainer if the client wants DeployOpen to keep the integration working between releases.

How the integration differs on Frappe Cloud and self-hosted ERPNext

Shared benches on Frappe Cloud are the most constrained option for device integration. The platform runs many customer sites on common infrastructure, so the sites you can reach are limited by what the provider allows on that tier. Frappe's Server Script documentation states that Frappe Cloud public shared benches do not allow server scripts, which removes the most flexible way to transform raw punches inside the site. Before you commit to a method, confirm the following with the provider:

  • Server scripts: whether custom Python endpoints or document event hooks are permitted on your plan.
  • Scheduled imports: whether you can run a recurring CSV or file import, or need to drive it from an external job that calls the site API.
  • Inbound API access: whether your site accepts calls from the device gateway or middleware at the network addresses you use.
  • Outbound network rules: whether the site can reach a device or a local collector on your network without a VPN or tunnel.
  • Upgrade and support terms: which Frappe version your site runs and whether it is covered by a matching support plan.

If the provider blocks any of these, plan for an external collector that writes into Frappe HR through its API, or move to a dedicated bench.

Running the attendance feed after go-live

The attendance feed needs a named owner after go-live, and that owner should be someone who will check it every working day. Once punches flow into Employee Checkin, the risk moves from installation to drift: imports fail quietly, devices get replaced, clocks wander and new hires appear without a device ID. Name one person in HR operations and one backup in IT. Give them a short written runbook that covers who fixes a failed import, who approves a device swap and who is told when an employee has no mapped Attendance Device ID. Confirm with your partner or Frappe HR documentation which import and sync logs the version you run exposes, so the owner knows where failures show up.

Reconcile Employee Checkin records against the device's own log on a fixed cadence, starting with a sample of several days after go-live and then a regular monthly check before payroll closes. Compare counts per employee and per device, and look for punches that are missing, duplicated or stamped on the wrong date. Time drift is the most common silent fault: a device clock that runs fast or slow shifts punches across shift boundaries, which then affects Auto Attendance. Check device clocks against a trusted time source at a set interval and record each correction. When a device is replaced, keep the old device's last punch timestamp, map the new device to the same location, and confirm that the Attendance Device IDs on employee records still match before the first punch arrives.

Treat the scheduler and background jobs as the first place to look when punches stop appearing, not as an area you can ignore until something breaks. Confirm that the scheduler is running on the site, that the jobs which process imports and attendance are queued and completing, and that failures alert the owner. Ask your partner which of these checks apply to your hosting model, because a Frappe Cloud site and a self-hosted bench expose them differently. Finally, build a joiner step into HR onboarding so every new employee receives an Attendance Device ID before their first shift, and add a leaver step that stops mapping them. Most missed punches in mature deployments trace back to a new hire who was never mapped.

How DeployOpen scopes and delivers biometric attendance integration

DeployOpen plans, implements, customizes, integrates, documents and supports self-hosted open-source platforms inside your own infrastructure. For biometric attendance, that means agreeing in writing which device models, punch log sources and Frappe HR settings are in scope, then building and testing the path from device to Auto Attendance before go-live.

How we scope

  • Inventory every device model, firmware generation and network path that will send punch logs to Frappe HR.
  • Confirm which Attendance Device IDs, Employee Checkin records and shift assignments the integration must produce.
  • Agree in writing whether the feed uses CSV import, the check-in API or both, and who owns each step.

How we build

  • Configure Employee Checkin and Attendance Device ID mapping against a sample of real punch records from each device type.
  • Test Auto Attendance by shift, including late punches, missed punches, night shifts and employees on more than one shift.
  • Set up scheduled imports or API calls with logging, so failed punches are visible and can be replayed.

How we hand over

  • Deliver the written configuration, device mapping table, import templates and the test cases used for sign-off.
  • Document how to add a device, rename an employee ID, and correct a bad punch without breaking attendance history.
  • Walk your HR and IT operators through daily checks, reconciliation reports and the escalation path for device faults.

How we support

  • Ongoing support, upgrades and testing are available as a retainer, sized to the number of devices and sites you run.
  • Review Frappe HR and ERPNext releases before upgrades, since attendance and shift behavior can change between versions.
  • Confirm with your device vendor which firmware, protocol and push or pull options your models support before any build starts.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.