Authentication
Quick answer
Use OAuth or certificates over basic auth, always use TLS, store credentials/secrets securely (never in code), and apply least-privilege scopes/authorizations to integration users.
Key takeaways
- For S/4HANA Cloud and BTP APIs, OAuth 2.
- Authentication proves identity; the API then checks authorization (the backend authorization objects/roles) for what the caller may…
- OAuth 2.0: token-based, preferred for cloud/modern APIs.
- Watch out: Basic auth over HTTP, credentials exposed.
Common authentication methods
- OAuth 2.0: token-based, preferred for cloud/modern APIs.
- Basic authentication: user/password, simple but weaker; avoid over HTTP.
- Certificate-based (X.509 / mTLS): strong, common for system-to-system.
- SAML/principal propagation: passing user identity through integration.
OAuth in the SAP context
For S/4HANA Cloud and BTP APIs, OAuth 2.0 is standard: a client obtains a token (e.g. client-credentials for system integration) and sends it as a bearer token. This avoids storing user passwords and supports scoped, revocable access, the modern best practice.
Authorization still applies
Authentication proves identity; the API then checks authorization (the backend authorization objects/roles) for what the caller may access. Both matter: an authenticated caller with insufficient authorization still gets a 403.
Security practices
Use OAuth or certificates over basic auth, always use TLS, store credentials/secrets securely (never in code), and apply least-privilege scopes/authorizations to integration users.
Common pitfalls
- Basic auth over HTTP, credentials exposed.
- Secrets in code instead of a secure store.
- Over-privileged integration users.
Want to learn this properly?
Our live, instructor-led SAP Training covers this hands-on, with real projects and a certification path.
Check your understanding
Which statement is true of Authentication?
- A. SAP is the global market leader in enterprise resource planning software by revenue, and its dominance among…
- B. Backing up SAP HANA protects the database, the store of all application data, so it can be recovered after…
- C. 0 is standard: a client obtains a token (e.
Show answer
C. 0 is standard: a client obtains a token (e.
Covered in the “OAuth in the SAP context” section of this lesson.
Which of these also applies to Authentication?
- A. Backing up data but not logs, no point-in-time recovery.
- B. g.
- C. Guessing instead of reading the log/dump.
Show answer
B. g.
Covered in the “OAuth in the SAP context” section of this lesson.
Which part of the Learn SAP curriculum covers Authentication?
- A. SAP APIs
- B. SAP reference
- C. SAP performance tuning
Show answer
A. SAP APIs
This lesson sits in the SAP APIs section of the Learn SAP course.