Frontend boundary

Connecting a separately hosted frontend to an application service: authentication, routing, access to backend systems, user identity propagation and tenant isolation across the hosting boundary.

Overview

Exposing a CAP service to a frontend that does not live inside BTP. Authenticating an externally-hosted app against an XSUAA or IAS-protected service, what replaces the approuter when the frontend is on a CDN, destinations from outside BTP, principal propagation, and multitenancy under edge caching.

SAP SHIPS

Node.js →

@sap/cds Scaffolds a starter frontend with cds add vue or cds add react, and wires SAP Build Application Frontend with cds add app-frontend.

Not covered: It stops at frontends the platform hosts. Everything the paved road provides — routing, token exchange, tenant resolution — comes from the Application Frontend service, so a frontend hosted anywhere else takes all of it back on: authenticating against XSUAA or IAS from outside, replacing the approuter, reaching destinations, and keeping tenants apart under edge caching.

Built into @sap/cds

SourceVue.js and React UIschecked 2026-08-31