> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect SAP Concur with Company Request Token – StackOne Hub

> Link a SAP Concur account in the StackOne Hub using Company Request Token. End-user guide to authorize the integration and start using SAP Concur actions.

> [!WARNING]
>
> SAP Concur must first enable the OAuth 2.0 Application Management tool for your company, which you request from Client Web Services. SAP Concur lists the tool in the US2, EU2 and APJ1 data centers. You also need the Web Services Administrator role (in Standard Edition, the Can Administer permission). SAP Concur also says to contact your SAP Concur account representative to update your Company JWT scopes to access the Identity v4.1 endpoints, as described in its [Identity v4.1 guide](https://developer.concur.com/api-guides/profile/identity-search.html).

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Find your data center

The data center is the SAP Concur location that hosts your company, and each one has its own API address.

<ul>
  <li>SAP Concur lists the address of every data center on its [Base URIs page](https://developer.concur.com/platform/base-uris.html).</li>
  <li>US2: `https://us2.api.concursolutions.com`</li>
  <li>EU2: `https://eu2.api.concursolutions.com`</li>
  <li>APJ1: `https://apj1.api.concursolutions.com`</li>
  <li>US Government (CCPS): `https://usg.api.concursolutions.com`</li>
  <li>Pick the matching option in the **Data Center** field in StackOne Hub. If you do not know it, ask your SAP Concur account representative.</li>
  <li>SAP Concur lists the app tool for US2, EU2 and APJ1 only. A US Government company asks SAP Concur support for a Client ID.</li>
  <li>If the connection test says SAP Concur did not find its token service or redirected the request, check the **Data Center** choice.</li>
</ul>

## Create the app

The app gives StackOne its own **Client ID** and **Client Secret**. Everything it reads is limited to the scopes you select.

**1. Sign in to SAP Concur**

Sign in to your [SAP Concur account](https://www.concursolutions.com) as a Web Services Administrator.

<ul>
  <li>Navigate to **Administration** > **Company** > **Authentication Admin**.</li>
</ul>

**2. Open OAuth 2.0 Application Management**

Select **OAuth 2.0 Application Management** to open the **Application List**, then select **Create New App**.

<ul>
  <li>You can also open [OAuth 2.0 Application Management](https://www.concursolutions.com/nui/ocstool) directly.</li>
</ul>

**3. Fill in the app details**

Fill in the first fields on the **Create New App** screen.

<ul>
  <li>**App Name**: `StackOne Integration`. SAP Concur asks you to include the company, partner or team name.</li>
  <li>**App Description**: say that StackOne reads users and roles.</li>
  <li>**App Stage**: Production for a live company. SAP Concur also offers Development and Test.</li>
  <li>**Application Type**: Web Services (WS) Client. SAP Concur also offers Integration with Concur Solutions (ICS) Client.</li>
</ul>

**4. Choose the allowed grants**

Under **Allowed Grants**, select the Password grant, which StackOne uses once to exchange the Company Request Token, and the Refresh grant, which keeps the access token current.

**5. Choose the allowed scopes**

Enables actions: Get Identity User, Get Spend User, Get Unified Role, Get Unified User, List Identity Users, List Spend Role Codes, List Spend Users, List Unified Roles, List Unified Users

Under **Allowed Scopes**, select all four scopes below. StackOne reads only, and each scope covers a different part of a user. `identity.user.ids.read` returns the user ID and user name, `identity.user.core.read` returns the active flag and the names, `identity.user.coresensitive.read` returns email addresses, and `spend.user.general.read` returns the Expense, Invoice and Request roles. StackOne needs all four. The connection test checks for user names, names and email addresses, and for Spend access when the first user has a Spend record.

<ul>
  <li>
    identity.user.ids.read
  </li>

  <li>
    identity.user.core.read
  </li>

  <li>
    identity.user.coresensitive.read
  </li>

  <li>
    spend.user.general.read
  </li>
</ul>

**6. Copy the Client ID and Client Secret**

Select **Submit**. The **App Credentials** page shows the **Client ID** and **Client Secret**. Copy both before you select **OK**.

<ul>
  <li>You can view both again later by selecting the Client ID in the **Application List**.</li>
  <li>Format for both: a UUID in the form `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`</li>
  <li>Paste the Client ID into the **Client ID** field and the secret into the **Client Secret** field in StackOne Hub.</li>
</ul>

## Create the Company Request Token

StackOne exchanges the Company Request Token for an access token and a refresh token. Create it last, because it expires 24 hours after you create it.

**1. Open Company Request Token**

Go back to **Administration** > **Company** > **Authentication Admin** and select **Company Request Token** to open the **Company Request Tokens** page.

<ul>
  <li>You can also open the [Company Request Token](https://www.concursolutions.com/nui/authadmin/companytokens) page directly.</li>
</ul>

**2. Submit the Client ID**

Enter the Client ID of your app in the **App ID** field and select **Submit**.

**3. Copy the Company UUID and token**

The **Company Request Token Successfully Created** dialog shows the **Company UUID** and the **Company Request Token**. Copy both before you select **OK**.

<ul>
  <li>Paste them into the **Company UUID** and **Company Request Token** fields in StackOne Hub.</li>
  <li>Format for both: a UUID in the form `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`</li>
  <li>If the token expires before you finish, enter the Client ID in **App ID** again and select **Submit** to create a new one.</li>
</ul>

## Keep the connection working

StackOne exchanges the Company Request Token for an access token that lasts one hour, then renews it with a refresh token.

<ul>
  <li>SAP Concur says a refresh token lasts six months and that its value can change.</li>
  <li>If the refresh token expires or is revoked, repeat the Company Request Token section for the same app and reconnect.</li>
  <li>SAP Concur's OAuth 2.0 Application Management tool can generate a new Client Secret for an existing app. StackOne sends the Client Secret each time it renews the access token, so after you generate a new one, repeat the Company Request Token section and reconnect in StackOne Hub with the new **Client Secret**.</li>
  <li>SAP Concur describes revoking refresh tokens with an API call in the Revoking a token section of its [Authentication page](https://developer.concur.com/api-reference/authentication/apidoc.html). The call needs an access token for your company, which you get from a new Company Request Token with the Password grant command shown on the Company Request Tokens page.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Client ID**</li>
  <li>**Client Secret**</li>
  <li>**Company UUID**</li>
  <li>**Company Request Token**</li>
  <li>**Data Center**</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.