> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect SAP S/4HANA with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a SAP S/4HANA account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using SAP S/4HANA actions.

> [!WARNING]
>
> Private Edition and on-premise systems only. Basis administrator access (SICF, /IWFND/MAINT\_SERVICE, SOAUTH2) is required. For SAP S/4HANA Cloud Public Edition use Basic Auth, Client Certificate or OAuth 2.0 (Authorization Code + PKCE) instead.

## Find your API host

The API host is the HTTPS host and port of your system's OData endpoint.

**1. Get the host from your Basis team**

Use the host and port that serve `/sap/opu/odata`, for example `s4.example.com:44300`.

## Activate the OAuth token service

The token endpoint is an ICF service that must be active.

**1. Activate the service in SICF**

In transaction **SICF**, activate `default_host/sap/bc/sec/oauth2`. Tokens are then issued at `https://<host>/sap/bc/sec/oauth2/token`.

## Enable OAuth on the OData services

Each OData service you want to call must allow OAuth.

**1. Enable OAuth per service**

In **/IWFND/MAINT\_SERVICE**, select each service and enable **OAuth**. This creates its OAuth scope.

<ul>
  <li>`API_BUSINESS_PARTNER` (scope `API_BUSINESS_PARTNER_0001`) for Business Partner, Customer and Supplier</li>
  <li>`API_SALES_QUOTATION_SRV`, `API_SALES_CONTRACT_SRV`, `API_SLSPRICINGCONDITIONRECORD_SRV`</li>
  <li>`API_CUSTOMER_MATERIAL_SRV`, `API_MATERIAL_STOCK_SRV`, `API_MATERIAL_DOCUMENT_SRV`, `API_BILLING_DOCUMENT_SRV`</li>
  <li>If the service is registered under a different technical name (e.g. `ZAPI_...`), its scope uses that name</li>
</ul>

## Register the OAuth client

The OAuth client is tied to a technical user whose roles allow the APIs.

**1. Create the client in SOAUTH2**

In transaction **SOAUTH2**, create an OAuth 2.0 client for a technical (system) user.

<ul>
  <li>The **Client ID** is the technical user name; the **Client Secret** is that user's password</li>
  <li>Enable the **Client Credentials** grant type</li>
  <li>Assign the scopes of every service you enabled, e.g. `API_BUSINESS_PARTNER_0001`</li>
</ul>

**2. Authorize the technical user**

Calls run as the technical user, so give it roles (PFCG) that allow the APIs, including authorization object `S_SCOPE` for the OAuth client and its scopes.

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.