TutorialTutorialA step-by-step walkthrough. The steps are the part that ages.See every one →SAP Developer Center
Use mocking to embrace auth in your domain model from the outset
Mock users locally so authorization is modelled from the first commit instead of retrofitted — the argument being that auth added late reshapes a domain model rather than sitting on top of it.
Where it sits
Explains
AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.Local developmentLocal developmentRunning the whole stack on a laptop against real bindings — the service, the UI and the routing in front of it — without deploying to see a change.
Who is behind it
SAPauthor
Properties
About this work
Published on
Group by76 of 76 pieces
Piece, what it offersStill applies
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2ABuilding a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2AThe third instalment of a three-part series deploys an already-built CAP service and LangGraph agent to SAP BTP, Cloud Foundry Runtime, wraps the agent in an A2A protocol server, and registers it with SAP Joule through a capability YAML and the @sap/joule-studio-cli, confirming the chain works end to end inside a real Joule assistant. It covers CAP's default JWT/XSUAA authentication in production, what a test deployment needs to get past it, and the cf push, mbt build and environment wiring that run both apps as separate Cloud Foundry containers. A closing section names what stays unfinished by design — a long-lived AI Core service key, no authentication on the BTP destination, no principal propagation — as the gap between this MVP and a production posture.rodfior, published 2026-08-20
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-1]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-1]The first of six, and it does the thing the later parts depend on: build the Incident Management application against SQLite on a laptop, with no cloud database in sight. The series is called decoupled because the front end and the back end are deployed separately, and this part is entirely the back end.sanjucs, published 2026-05-06
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-1]
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Don't Wait for SAP: Unlocking MCP Servers in BAS Right NowDon't Wait for SAP: Unlocking MCP Servers in BAS Right NowA workaround post with a grievance behind it: MCP servers were promoted heavily at SAP TechEd, most IDEs support them, and Business Application Studio limits you to Joule. This is how to run them there anyway. Worth reading as evidence of where the tooling gap sits rather than only for the recipe, which by nature has a shelf life.published 2025-11-27
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Establishing connectivity between a local CAP runtime and on-premise systemsEstablishing connectivity between a local CAP runtime and on-premise systemsReaching S/4HANA, an on-premise HANA or any HTTP service from a CAP process running on your laptop — the case where the connectivity proxy the platform provides is not there and the tunnel has to be arranged.vLeonkev, published 2025-10-15
Creating a Hybrid CAP (Node.js) Profile with PostgreSQL on BTP from Business Application StudioCreating a Hybrid CAP (Node.js) Profile with PostgreSQL on BTP from Business Application StudioHybrid testing is documented for HANA; this is the same profile against a PostgreSQL instance on BTP, driven from a BAS dev space rather than a laptop. Proposed under editor support because of where it runs, but the subject is the binding: what cds bind writes, and what has to be true of the service instance and the tunnel for a local process to reach it.valentincadart, published 2025-10-02
Creating a Hybrid CAP (Node.js) Profile with PostgreSQL on BTP from Business Application Studio
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects Runnable code.
CAP with Local App Previews – Tips for Smooth DevelopmentCAP with Local App Previews – Tips for Smooth DevelopmentUI5's virtual endpoints remove the sandbox files a local preview used to need, and this is what that means for a CAP project specifically. Tips from trying it rather than an announcement of it.MioYasutake, published 2025-08-16
How to Call a Remote OData API from Your Local CAP Java ProjectHow to Call a Remote OData API from Your Local CAP Java ProjectThe Business Accelerator Hub sandbox called from a CAP Java project on a laptop, with a concrete finish line — a localhost URL that returns business partners. Everything needed to get there is listed, Maven and JDK versions included.Umezuki, published 2025-08-11
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
How to fix npm error notarget @sap/hdi-deploy when you create a CAP app in BASHow to fix npm error notarget @sap/hdi-deploy when you create a CAP app in BASA specific npm failure when creating a CAP app from a template, and the post now opens with its own July 2025 update saying the version has been published so this instance is gone. It stays useful because the cause — a dependency pointing at a version nobody published yet — recurs, and the unblocking steps are general.Ryota_Ito, published 2025-07-28
Identity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesIdentity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesSAP Cloud Identity Services is the central identity interface for single sign-on across an SAP landscape: browser-based applications authenticate through SAML 2.0 or OpenID Connect, while applications reached over RFC rather than HTTP use Secure Login Client and Secure Login Service instead, since those web protocols do not apply there. That RFC path issues short-lived X.509 certificates from SCI-authenticated identities, carrying the same multi-factor authentication into on-premise access, with Kerberos tokens or local client certificates as alternatives.OxanaJ, published 2025-07-25
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Guide to Process Automation APIs - Part I - Getting StartedGuide to Process Automation APIs - Part I - Getting StartedExplains how to call SAP Build Process Automation's REST and OData APIs directly: OAuth2 client credentials with a service key runs as the service, while a user token (OAuth2JWTBearer) runs as the calling person, which matters wherever an API records who acted — approving a task, or reading instances from a shared environment. Since the Public environment is deprecated as of the end of 2025, a call into any other environment also needs an environmentId query parameter.Dan_Wroblewski, published 2025-07-14
Making the Case for Enhanced REST Adapter in SAP Integration SuiteMaking the Case for Enhanced REST Adapter in SAP Integration SuiteCatalogues what SAP Integration Suite's native HTTP adapter supports for authentication (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handling (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPI import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.peter_ha3, published 2025-07-14
Remote Debugging of SAP CAPM App - NodejsRemote Debugging of SAP CAPM App - NodejsDebugging a CAP Node.js application that is not on your machine, built up from cds init and a custom action so there is something to breakpoint. The part people need is at the end; the beginning is there so the end is reproducible.darshanv23, published 2025-06-05
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
CAPM Basics - Part 4CAPM Basics - Part 4Part 4 of a CAPM Basics series binds the deployed XSUAA and SAP HANA Cloud service instances with cds bind and runs the project against them from a laptop via cds watch --profile hybrid, the hybrid-testing loop @sap/cds-dk provides. It then restricts the service with @restrict (READ granted to a Viewer role, full access to Admin) and adds OData Capabilities restrictions plus @odata.draft.enabled so a Fiori elements client renders create, update and delete without UI code. It closes by adding a UI module with the SAP Fiori Generator, wiring an approuter via cds add approuter to forward the auth token, and updating the SAP Authorization and Trust Management service instance with the generated redirect URI before redeploying.archisman92, published 2025-05-10
CAPM Basics - Part 2CAPM Basics - Part 2Walks through deploying a CAP application to SAP BTP, Cloud Foundry Runtime: provisioning a SAP HANA Cloud instance and HDI container, then running cds add hana and cds add xsuaa --for production, cds build --production, and an MTA build and deploy. Tests the deployed service in Postman with an OAuth 2.0 client credentials token from the XSUAA binding (SAP Authorization and Trust Management service), explicitly leaving out any role templates or scopes.archisman92, published 2025-02-28
SAP CAP Lessons Learned: SQLite is single threaded, HANA is notSAP CAP Lessons Learned: SQLite is single threaded, HANA is notA page long, and one of the more useful pages here: the local database serialises what the deployed one runs in parallel, so concurrency bugs are invisible until they are not. Filed by the author as something the tutorials do not make clear.LucasMagriniRigo, published 2025-01-22
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
My CAP Projects ToolboxMy CAP Projects ToolboxA working inventory of daily CAP tooling: scaffolding a project with cds init and growing it facet by facet through cds add (TypeScript, seed data, an .http test file, a handler stub), then running it with cds watch and setting a breakpoint in a custom handler from SAP Business Application Studio's JavaScript Debug Terminal. It also walks through an @open entity that accepts properties the model never declared, and reading temporal data defined with CAP's temporal aspect, where a plain read returns only what is valid now and a custom handler is needed to retrieve every time slice.vvdries, published 2024-12-23
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
Avoid design time CAP server restarts when maintaining local data filesAvoid design time CAP server restarts when maintaining local data filescds watch restarting on every file change is the feature; this is the case where it is not. Editing a CSV seed file mid-edit restarts the server against half-finished data, and the post is about suppressing that without giving up the watch loop. A small friction most people work around silently rather than fix.published 2024-04-26
Avoid design time CAP server restarts when maintaining local data files
Local development changed in @sap/cds-dk 7.9.1, 2024-05-02. Affects Runnable code.
Develop CAP Project with Lazyvim in DockerDevelop CAP Project with Lazyvim in DockerA Docker image running Lazyvim with language server support for CDS, TypeScript and JSON, so a CAP project can be developed with an editing experience comparable to VS Code without leaving the keyboard. Narrow by intent, and the useful general point underneath it is that CAP's editor support reaches anything that speaks LSP.published 2024-03-28
cds-launchpad-plugin supercharged & ready for the future - CAP Plugin, UI5 Tooling support & Async Launchpadcds-launchpad-plugin supercharged & ready for the future - CAP Plugin, UI5 Tooling support & Async LaunchpadThe maintainer on a set of changes rather than on the plugin's original purpose, which is indexing every SAPUI5 project in a workspace into one sandbox launchpad so all of them can be tested together. What moved: it became a CAP plugin, gained UI5 Tooling support, and moved to the async launchpad — each framed as keeping pace with where SAPUI5 itself is going rather than as a feature.published 2023-12-11
CAP PostgreSql setup local debugging using Docker - Part 2CAP PostgreSql setup local debugging using Docker - Part 2PostgreSQL in a container so the local loop matches the deployed one — the thing SQLite quietly stops you doing. Short, and it assumes the project from part one already runs.ramonlee5, published 2023-11-22
CAP PostgreSql setup local debugging using Docker - Part 2
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
SAP Tech Bytes: Using the SAP Approuter at dev time - a full-stack journey with UI5 and CAPSAP Tech Bytes: Using the SAP Approuter at dev time - a full-stack journey with UI5 and CAPGetting UI5 Tooling and the CAP server onto one port under one command, using cds-plugin-ui5 — which the post presents as the thing that removes the proxy and destination configuration a full-stack dev setup otherwise needs. Part one of a journey that goes on to put the approuter in front at development time.published 2023-10-13
SAP Tech Bytes: Using the SAP Approuter at dev time - a full-stack journey with UI5 and CAP
cds-plugin-ui5 has been through 11 major lines since this was published, most recently 0.15 (2025-11), 0.16 (2025-12), 0.17 (2026-03). Affects Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Proof Key for Code Exchange against Identity Authentication, revisited by the author after an earlier post on the same subject — the flow that lets a mobile or single-page client authenticate without a secret it cannot keep. Sample repository under SAP-samples.martinfrick, published 2023-09-21
Hybrid testing using PostgreSQL on SAP BTP, hyperscaler optionHybrid testing using PostgreSQL on SAP BTP, hyperscaler optionA short note rather than a guide — the author says they came across the feature reading someone else's post on PostgreSQL with Kyma. Hybrid testing against a real PostgreSQL instance, which until then people assumed meant HANA.martinfrick, published 2023-08-08
The fastest and easiest way to run full-stack applications in SAP Business Application StudioThe fastest and easiest way to run full-stack applications in SAP Business Application StudioThe gap between a mocked local run and a real one, and the tooling that closes it — live data, remote services, defaults overridden. The same author's Run Configurations post is the reference for the tool; this is the case it was built for.liat_b, published 2023-08-02
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
CAP Typescript + Fiori Typescript + live reload Initial app setupCAP Typescript + Fiori Typescript + live reload Initial app setupA full-stack TypeScript starting point recorded as it was arrived at — the terminal commands and the configuration files, in order, for the CAP side, the conversion to TypeScript, and then the Fiori side. The author is explicit that it takes a while to go through, which is the honest framing for a setup that has this many steps.Christophe_SW, published 2023-06-18
CAP Typescript + Fiori Typescript + live reload Initial app setup
TypeScript patterns changed in @cap-js/cds-typer 0.5.0, 2023-07-25. Affects Runnable code.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Surviving and Thriving with the SAP Cloud Application Programming Model: Local development hurdlesSurviving and Thriving with the SAP Cloud Application Programming Model: Local development hurdlesThree hurdles in running a CAP application locally: services mocked with cds run --with-mocks return no data across OData associations until the ON clause is hand-written into the imported CDS, an on-premise API reached through the SAP Cloud Connector times out because its proxy is part of destinations and connectivity and reachable only from inside SAP BTP, and a Fiori frontend served from the HTML5 Application Repository needs the HTML5 Repo Mock to reach a local backend at all. It closes with the launch configurations the author uses for debugging cds watch locally and attaching to a running Cloud Foundry instance.maxstreifeneder, published 2023-02-02
BTP CAP : How to Connect to Remote Services Locally in CAP ApplicationBTP CAP : How to Connect to Remote Services Locally in CAP ApplicationThe same problem four years earlier: a CAP application that consumes a remote service, running locally against the real thing rather than against a mock.showkath_naseem, published 2022-12-12
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
加速开发和部署的CAP CDS和Fiori一些实用命令加速开发和部署的CAP CDS和Fiori一些实用命令In Chinese. A command reference rather than a walkthrough — cds import, cds compile, cds deploy --to sqlite, cds add hana, cds add xsuaa — grouped by what they are for. The kind of page that is more useful than a tutorial once you already know what you are doing.TiaXu, published 2022-10-21
加速开发和部署的CAP CDS和Fiori一些实用命令
Generators has changed twice since this was published, most recently in @sap/cds-dk 10.0.3, 2026-07-02. Affects A recipe, Runnable code.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
A Fiori Launchpad Sandbox for all your CAP-based projects - OverviewA Fiori Launchpad Sandbox for all your CAP-based projects - OverviewWhere cds-launchpad-plugin came from, told as a learning exercise: the author wanted a real problem to teach himself TypeScript on, and picked the thing he kept redoing in every CAP project — a launchpad to see all the UI applications in one place. The origin post for an entry whose 2023 update is also indexed here.published 2022-03-14
A Fiori Launchpad Sandbox for all your CAP-based projects – Sample project setupA Fiori Launchpad Sandbox for all your CAP-based projects – Sample project setupThe hands-on half published the same day as the overview: the launchpad module wired into the CAP sample repository, step by step from a global cds-dk install. Same-day pairs like this are worth keeping together — the overview argues, this one is the thing you follow.published 2022-03-14
Use Tasks in Visual Studio Code to start a cds service, an approuter and launch a browser in one goUse Tasks in Visual Studio Code to start a cds service, an approuter and launch a browser in one gocds watch serves the service and the app folder but not the approuter, so anything needing a JWT means a second terminal started by hand. This replaces that with a VS Code task definition — the tasks.json is in the post — so the whole local stack comes up on one command.pieterjanssens, published 2021-04-09
Use Tasks in Visual Studio Code to start a cds service, an approuter and launch a browser in one go
Local development has changed twice since this was published, most recently in @sap/cds-dk 7.9.1, 2024-05-02. Affects Runnable code.
SAP Cloud Application Programming Model（CAP）：概要およびデモ - Part 1SAP Cloud Application Programming Model（CAP）：概要およびデモ - Part 1Introduces SAP Cloud Application Programming Model as an open, opinionated framework that shoulders OData plumbing and database-specific code so a domain is modelled once in CDS, then builds a small bookshop project to show it: @sap/cds-dk's cds init scaffolds the project, cds watch serves it locally with live reload against an in-memory SQLite database, and a CatalogService projects a CDS domain model seeded from CSV files. The result is read as an OData service in the browser and exercised further through a Postman collection, with the optional @sap/vscode-cds extension noted for CDS syntax highlighting and completion in VS Code.rasai, published 2020-12-31
Running CAP Node Applications in SAP Business Application StudioRunning CAP Node Applications in SAP Business Application StudioThe Run Configurations tool, which is where binding and mocking live in BAS rather than in a terminal. Three things it does: several named configurations per application in a tree, dependencies bound to real service instances, and OData dependencies mocked. The author notes the configurations are standard launch entries underneath, which is the detail that lets you leave the tool behind if you want to.liat_b, published 2020-10-22
Use SCP CF Destination service in NodeJs locallyUse SCP CF Destination service in NodeJs locallyReading a destination from a laptop, where the environment variable the destination service normally provides does not exist. A small gap with a real cost, since the alternative is deploying to test every change to a remote call.WouterLemaire, published 2020-05-28
Use SCP CF Destination service in NodeJs locally
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Develop SAP CAP apps inside a VS Code Docker ContainerDevelop SAP CAP apps inside a VS Code Docker ContainerA VS Code dev container configuration with everything a CAP project needs already in it, published as a repository rather than as instructions. The 2020 half of a pair whose other half, four years later, does the same for Lazyvim — the same author solving the same problem twice as his editor changed.published 2020-02-20
Develop SAP CAP apps inside a VS Code Docker Container
Local development has changed twice since this was published, most recently in @sap/cds-dk 7.9.1, 2024-05-02. Affects Runnable code.
Set up VS Code on Chrome OS for local Application Programming Model developmentSet up VS Code on Chrome OS for local Application Programming Model developmentA CAP development environment on a Chromebook, written from preference rather than constraint — the author sets out why Chrome OS is his primary machine before showing the setup. Carries its own updates section noting what has changed since, which for a 2018 post about an operating system is most of it. The interest now is that local CAP development was portable this early.published 2018-10-16
Set up VS Code on Chrome OS for local Application Programming Model development
Local development has changed twice since this was published, most recently in @sap/cds-dk 7.9.1, 2024-05-02. Affects Runnable code.
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Create a Simple CAP Application and Explore the DefaultsCreate a Simple CAP Application and Explore the DefaultsThe shortest way in: a project from the wizard, then a look at what CAP assumed on your behalf. The defaults are the subject rather than the application — which is the right first lesson in a framework whose whole argument is convention over configuration.SAP
Get an introduction to the cds REPLGet an introduction to the cds REPLcds repl as a way to ask the running model questions directly, which is the fastest route from a suspicion about a query to knowing.SAP
Set up a self-contained development environment for CAP Node.jsSet up a self-contained development environment for CAP Node.jsA CAP development environment that carries its own dependencies, so the machine it runs on stops being part of the setup.SAP
Details
Graph
Authenticationcapability, core and community
Local developmentcapability, core and community
SAP Developer Centerpublishing source
SAP Developer Centergraphql
Source
Type
tutorial
Published on
Host
developers.sap.com
Discovered via
First seen
History
- Entered the atlasDiscovered via SAP Developer Center · graphql.
For your agent
- Ref
content:sap-tutorial-cap-mocking-auth- JSON
- /content/sap-tutorial-cap-mocking-auth.json
- MCP
- Connecting an agent