Skip to main content
SAP Concur must first enable the OAuth 2.0 Application Management tool for your company, which you request from Client Web Services. SAP Concur lists the tool in the US2, EU2 and APJ1 data centers. You also need the Web Services Administrator role (in Standard Edition, the Can Administer permission). SAP Concur also says to contact your SAP Concur account representative to update your Company JWT scopes to access the Identity v4.1 endpoints, as described in its Identity v4.1 guide.

​
Find your data center

The data center is the SAP Concur location that hosts your company, and each one has its own API address.

  • SAP Concur lists the address of every data center on its Base URIs page.
  • US2: https://us2.api.concursolutions.com
  • EU2: https://eu2.api.concursolutions.com
  • APJ1: https://apj1.api.concursolutions.com
  • US Government (CCPS): https://usg.api.concursolutions.com
  • Pick the matching option in the Data Center field in StackOne Hub. If you do not know it, ask your SAP Concur account representative.
  • SAP Concur lists the app tool for US2, EU2 and APJ1 only. A US Government company asks SAP Concur support for a Client ID.
  • If the connection test says SAP Concur did not find its token service or redirected the request, check the Data Center choice.

​
Create the app

The app gives StackOne its own Client ID and Client Secret. Everything it reads is limited to the scopes you select.

1

Sign in to SAP Concur

Sign in to your SAP Concur account as a Web Services Administrator.

  • Navigate to Administration > Company > Authentication Admin.
2

Open OAuth 2.0 Application Management

Select OAuth 2.0 Application Management to open the Application List, then select Create New App.

3

Fill in the app details

Fill in the first fields on the Create New App screen.

  • App Name: StackOne Integration. SAP Concur asks you to include the company, partner or team name.
  • App Description: say that StackOne reads users and roles.
  • App Stage: Production for a live company. SAP Concur also offers Development and Test.
  • Application Type: Web Services (WS) Client. SAP Concur also offers Integration with Concur Solutions (ICS) Client.
4

Choose the allowed grants

Under Allowed Grants, select the Password grant, which StackOne uses once to exchange the Company Request Token, and the Refresh grant, which keeps the access token current.

5

Choose the allowed scopes

Enables actions: Get Identity User, Get Spend User, Get Unified Role, Get Unified User, List Identity Users, List Spend Role Codes, List Spend Users, List Unified Roles, List Unified Users

Under Allowed Scopes, select all four scopes below. StackOne reads only, and each scope covers a different part of a user. identity.user.ids.read returns the user ID and user name, identity.user.core.read returns the active flag and the names, identity.user.coresensitive.read returns email addresses, and spend.user.general.read returns the Expense, Invoice and Request roles. StackOne needs all four. The connection test checks for user names, names and email addresses, and for Spend access when the first user has a Spend record.

6

Copy the Client ID and Client Secret

Select Submit. The App Credentials page shows the Client ID and Client Secret. Copy both before you select OK.

  • You can view both again later by selecting the Client ID in the Application List.
  • Format for both: a UUID in the form xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  • Paste the Client ID into the Client ID field and the secret into the Client Secret field in StackOne Hub.

​
Create the Company Request Token

StackOne exchanges the Company Request Token for an access token and a refresh token. Create it last, because it expires 24 hours after you create it.

1

Open Company Request Token

Go back to Administration > Company > Authentication Admin and select Company Request Token to open the Company Request Tokens page.

2

Submit the Client ID

Enter the Client ID of your app in the App ID field and select Submit.

3

Copy the Company UUID and token

The Company Request Token Successfully Created dialog shows the Company UUID and the Company Request Token. Copy both before you select OK.

  • Paste them into the Company UUID and Company Request Token fields in StackOne Hub.
  • Format for both: a UUID in the form xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  • If the token expires before you finish, enter the Client ID in App ID again and select Submit to create a new one.

​
Keep the connection working

StackOne exchanges the Company Request Token for an access token that lasts one hour, then renews it with a refresh token.

  • SAP Concur says a refresh token lasts six months and that its value can change.
  • If the refresh token expires or is revoked, repeat the Company Request Token section for the same app and reconnect.
  • SAP Concur’s OAuth 2.0 Application Management tool can generate a new Client Secret for an existing app. StackOne sends the Client Secret each time it renews the access token, so after you generate a new one, repeat the Company Request Token section and reconnect in StackOne Hub with the new Client Secret.
  • SAP Concur describes revoking refresh tokens with an API call in the Revoking a token section of its Authentication page. The call needs an access token for your company, which you get from a new Company Request Token with the Password grant command shown on the Company Request Tokens page.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Client ID
  • Client Secret
  • Company UUID
  • Company Request Token
  • Data Center
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.