onedevatlasBeta
Browse the atlas
AllBTPCAPUI5ABAP
ServiceServicetypeA BTP service you subscribe to and bind, rather than install. It has plans and regions, not versions, and may deliver a product that lives outside the atlas.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →

OAuth 2.0 on SAP BTP

OAuth 2.0 protection for applications and APIs on SAP BTP, listed in Neo regions: the authorization code grant for web applications and the client credentials grant for API and IoT scenarios.

OAuth 2.0 on SAP BTP sets up authentication and authorisation on the OAuth 2.0 protocol with two grant flows. The authorization code grant is for web applications: access permissions are flexible and can be revoked, and credentials are not stored at a third-party location. The client credentials grant issues an access token on the client's credentials alone, with no user interaction, for protecting an API or an IoT device. The one plan in the Discovery Center record, Default, is listed in Neo regions and in SAP's Riyadh and Moscow regions, and in no Cloud Foundry environment; in the Neo regions the service is being removed from the Eligible Cloud Services List on December 31, 2028, and a subscription cannot be kept past that date.

Retirement announcedThe regions the Discovery Center record marks as NeoThis Cloud Service, in the region/data center marked as "Neo", is being removed from the Eligible Cloud Services List on December 31, 2028 ("Retired Service").SAP Discovery Center — OAuth 2.0 on SAP BTP, plan availability
Homepage
Docs

Where it sits

Lives in
BTP/BAIP
Provides
AuthenticationBTPAuthenticationcapabilityEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.AuthorizationBTPAuthorizationcapabilityDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.

Who is behind it

SAPSAPOrganisationMaintains this
In the atlas: maintains 137, wrote 14@SAPmaintainer

What it declares

Every artifact

Type
Service
Origin
By SAP

For authentication

Supports
Token with no userPasses the user onCorporate IdP behind it
property statedstated nonot said

Tasks this contributes to1Beta

Authentication1
Get a token for a protected BTP endpoint with no user signed inA script, a job or another service calls a protected endpoint of a deployed SAP BTP application and is accepted, with nobody at a browser.Covers, under conditionsauthorization server, in the regions its one plan is listed in
What it does

Grants an access token on the client's credentials alone, with no user interaction, which the catalogue record names for protecting an API or an IoT device.

Conditions

The one plan in the Discovery Center record is listed in regions marked Neo and in no Cloud Foundry environment.; SAP states the service is being removed from the Eligible Cloud Services List on December 31, 2028 in those regions.

Remaining work

Check the entitlement before anything else: the plan has to exist in the region the application runs in, and a subscription has an end date.

All options on the Authentication page →

Connections3

Download
OAuth 2.0 on SAP BTP connectionsOAuth 2.0 on SAP BTPPROVIDES→ provides2provides stated Issues OAuth 2.0 access tokens through the authorization code grant for web applications and the client credentials grant for clients with no user present. SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946 SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946Authenticationprovides stated Grants a client access to an application or API through OAuth 2.0 access permissions that can be revoked, instead of shared credentials. SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946 SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946AuthorizationUSED BY← optionally used by1optionally used by derived If: OAuth 2.0 browser-based login is used for BTP ABAP Environment service-key development local browser-based login for BTP ABAP Environment service-key development Through: inverted from its requires edge arc-1 README: https://github.com/arc-mcp/arc-1arc-1if

Others providing28

Authentication
  1. abap_jwt_generatorGenerates signed JSON Web Tokens in ABAPfrom ABAP
  2. @arc-mcp/xsuaa-authXSUAA authentication stack for an MCP server on SAP BTPfrom BTP/BAIP
  3. abap-pwnedpasswordsChecks passwords against Have I Been Pwned from ABAPfrom ABAP
  4. SAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP appsfrom BTP/BAIP
  5. Cloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenantfrom BTP/BAIP
  6. SAP Customer Identity and Access Management for B2CRegistration, login and consent for customer-facing sitesfrom BTP/BAIP
  7. com.sap.cds:cds-feature-identityOAuth2 token validation from XSUAA and SAP Cloud Identity Servicesfrom CAP
  8. com.sap.cds:cds-feature-xsuaaFormer XSUAA JWT validation for CAP Java, removed in CAP Java 3.0from CAP
  9. abapOAuthAzureOA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAPfrom ABAP
  10. abap2oauth2ABAP API for OAuth 2.0 authenticationfrom ABAP
  11. abapNTLMHTTP NTLM client for ABAPfrom ABAP
  12. abap_cloud_platformTypeScript library reaching ABAP service instances on Cloud Foundryfrom BTP/BAIP
  13. decodesapsso2TypeScript decoder for MYSAPSSO2 logon ticketsfrom ABAP
  14. @marianfoo/sap-mcp-authBrowser login and session module for SAP MCP serversfrom BTP/BAIP
  15. @sap/approuterSAP's Node.js application router in front of business applicationsfrom BTP/BAIP
  16. @sap/cdsCAP Node.js runtimefrom CAP
  17. Cloud ConnectorSAP's on-premises agent linking SAP BTP to customer-network systemsfrom BTP/BAIP
  18. @sap/xssecToken validation and security context for XSUAA and IASfrom CAP
  19. cds-azure-adAzure AD and Azure AD B2C authentication strategy for CAPfrom CAP
  20. @saptools/cf-xsuaaOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingfrom BTP/BAIP
  21. cds-common-jwt-supportJWT authentication for CAP without xsuaa or xssecfrom CAP
  22. abap-aws-sigv4Signs outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.from ABAP
Authorization
  1. SAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP appsfrom BTP/BAIP
  2. com.sap.cds:cds-services-bomMaven bill of materials pinning CAP Java module versionsfrom CAP
  3. cap-toolkitUtility bundle for CAP handlers: builder, roles, validation, queriesfrom CAP
  4. @sap/ams-devCompiler from AMS DCL policies to DCN for local runs and testsfrom CAP
  5. @sap/amsAuthorization from DCL policies for Node.js apps on SAP Cloud Identityfrom CAP
  6. @sap/cdsCAP Node.js runtimefrom CAP
  7. sap-usi-authority-checkAuthority check helper class used across SchwarzIT's USI reportsfrom ABAP
  8. cds-entra-idMaps Microsoft Entra ID groups and app roles onto cds.User rolesfrom CAP

Details

Sources1
Added by handdiscovered herechecked

Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.

Compatibility and provenance
discovered viaAdded by hand
first seen in the atlas
ecosystem and domainbtp, security-and-compliance
History in the atlas3
  1. retirement-announced, effective 2028-12-31
  2. The BTP door now compares its authentication options on whether a token can be had with no person present. The catalogue sentence about the client credentials grant states it for this service, and it was read again on this date.
  3. First seen.
For your agent
Ref
artifact:btp-oauth
JSON
/artifacts/btp-oauth.json
MCP
Connecting an agent