onedevatlasBeta
Browse the atlas
AllBTPCAPUI5ABAP
ServiceServicetypeA BTP service you subscribe to and bind, rather than install. It has plans and regions, not versions, and may deliver a product that lives outside the atlas.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →

OAuth 2.0 on SAP BTP

OAuth 2.0 protection for applications and APIs on SAP BTP, listed in Neo regions: the authorization code grant for web applications and the client credentials grant for API and IoT scenarios.

OAuth 2.0 on SAP BTP sets up authentication and authorisation on the OAuth 2.0 protocol with two grant flows. The authorization code grant is for web applications: access permissions are flexible and can be revoked, and credentials are not stored at a third-party location. The client credentials grant issues an access token on the client's credentials alone, with no user interaction, for protecting an API or an IoT device. The one plan in the Discovery Center record, Default, is listed in Neo regions and in SAP's Riyadh and Moscow regions, and in no Cloud Foundry environment; in the Neo regions the service is being removed from the Eligible Cloud Services List on December 31, 2028, and a subscription cannot be kept past that date.

Retirement announcedThe regions the Discovery Center record marks as NeoThis Cloud Service, in the region/data center marked as "Neo", is being removed from the Eligible Cloud Services List on December 31, 2028 ("Retired Service").SAP Discovery Center — OAuth 2.0 on SAP BTP, plan availability
Homepage
Docs

Where it sits

Lives in
BTP/BAIP
Provides
AuthenticationBTPAuthenticationcapabilityEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.AuthorizationBTPAuthorizationcapabilityDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.

Who is behind it

SAPSAPOrganisationMaintains this
In the atlas: maintains 137, wrote 14@SAPmaintainer

What it declares

Every artifact

Type
Service
Origin
By SAP

For authentication

Supports
Token with no userPasses the user onCorporate IdP behind it
property statedstated nonot said

Tasks this contributes to1Beta

Authentication1
Get a token for a protected BTP endpoint with no user signed inA script, a job or another service calls a protected endpoint of a deployed SAP BTP application and is accepted, with nobody at a browser.Covers, under conditionsauthorization server, in the regions its one plan is listed in
What it does

Grants an access token on the client's credentials alone, with no user interaction, which the catalogue record names for protecting an API or an IoT device.

Conditions

The one plan in the Discovery Center record is listed in regions marked Neo and in no Cloud Foundry environment.; SAP states the service is being removed from the Eligible Cloud Services List on December 31, 2028 in those regions.

Remaining work

Check the entitlement before anything else: the plan has to exist in the region the application runs in, and a subscription has an end date.

All options on the Authentication page →

Connections3

Download
OAuth 2.0 on SAP BTP connectionsOAuth 2.0 on SAP BTPPROVIDES→ provides2provides stated Issues OAuth 2.0 access tokens through the authorization code grant for web applications and the client credentials grant for clients with no user present. SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946 SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946Authenticationprovides stated Grants a client access to an application or API through OAuth 2.0 access permissions that can be revoked, instead of shared credentials. SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946 SAP Discovery Center — OAuth 2.0 on SAP BTP: https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946AuthorizationUSED BY← optionally used by1optionally used by derived If: OAuth 2.0 browser-based login is used for BTP ABAP Environment service-key development local browser-based login for BTP ABAP Environment service-key development Through: inverted from its requires edge arc-1 README: https://github.com/arc-mcp/arc-1arc-1if

Others providing9

Authentication
  1. @arc-mcp/xsuaa-authXSUAA authentication stack for an MCP server on SAP BTP
  2. SAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP apps
  3. Cloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant
  4. SAP Customer Identity and Access Management for B2CRegistration, login and consent for customer-facing sites
  5. abap_cloud_platformTypeScript library reaching ABAP service instances on Cloud Foundry
  6. @marianfoo/sap-mcp-authBrowser login and session module for SAP MCP servers
  7. @sap/approuterSAP's Node.js application router in front of business applications
  8. Cloud ConnectorSAP's on-premises agent linking SAP BTP to customer-network systems
  9. @saptools/cf-xsuaaOAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
Authorization
  1. SAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP apps

Details

Sources1
Added by handdiscovered herechecked

Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.

Compatibility and provenance
discovered viaAdded by hand
first seen in the atlas
ecosystem and domainbtp, security-and-compliance
History in the atlas3
  1. retirement-announced, effective 2028-12-31
  2. The BTP door now compares its authentication options on whether a token can be had with no person present. The catalogue sentence about the client credentials grant states it for this service, and it was read again on this date.
  3. First seen.
For your agent
Ref
artifact:btp-oauth
JSON
/artifacts/btp-oauth.json
MCP
Connecting an agent