Skip to main content
Ensure you have Admin privileges for your SAP SuccessFactors account with permission for the Manage Integration Tools > Manage OAuth2 Client Applications.

​
Locating API Server

SAP uses multiple API server addresses. You will need to look up the API server that corresponds to your tenant domain.

1

Find Your API Server

Navigate to the SAP API Server Table and locate your tenant domain in the table.

  • For example, if your domain is https://pmsalesdemo8.successfactors.com/, search for salesdemo8 in the table
  • Copy the value in the API Server column (remove the trailing forward-slash)
  • Example: https://apisalesdemo8.successfactors.com

​
Find your learning domain URL (optional - for Learning/OCN actions only)

Your learning domain URL is required only for Learning or OCN actions like course import and completion tracking. This is the user-facing URL, NOT the API server URL.

1

Locate learning domain URL

Check your browser address bar when signed in to SAP SuccessFactors Learning.

  • Navigate to the Learning module in SAP SuccessFactors.
  • Look at the URL in your browser’s address bar.
  • Example: if your URL is https://salesdemo8.successfactors.com/learning/admin, your learning domain URL is https://salesdemo8.successfactors.com
  • Copy the base URL (everything before /learning).
2

Understand the difference from API server URL

SAP SuccessFactors uses different URLs for Learning APIs versus HRIS APIs.

  • Learning domain URL (NO api prefix): https://salesdemo8.successfactors.com - for OCN/Learning actions
  • API server URL (HAS api prefix): https://apisalesdemo8.successfactors.com - for HRIS actions
  • Notice: The API server URL typically has api added to the subdomain
  • Both URLs use the same OAuth credentials.
3

Verify the format

Ensure your learning domain URL follows the correct format.

  • ✅ Correct: https://salesdemo8.successfactors.com
  • ✅ Correct: https://pmsalesdemo.successfactors.com
  • ❌ Incorrect: https://apisalesdemo8.successfactors.com (this is the API server, not learning domain)
  • ❌ Incorrect: https://salesdemo8.successfactors.com/learning (remove /learning path)
  • ❌ Incorrect: https://salesdemo8.successfactors.com/learning/admin (remove all paths)
  • Leave this field blank if you only use HRIS actions and don’t need Learning module integration.

​
Finding Username

Your username is required for authentication and can be found in your SAP SuccessFactors profile.

1

Locate Your Username

Log in to SAP SuccessFactors and select your profile image in the upper right-hand corner of the screen.

  • Your username is the value in parentheses next to your name
  • Example: If you see ‘John Smith (jsmith)’, your username is jsmith
  • Copy this value and note it as your Username

​
Finding Company ID

The Company ID uniquely identifies your SAP SuccessFactors organization.

1

Access Version Information

Within the same profile dropdown, select Show version information.

2

Copy Company ID

In the modal that appears, locate and copy the Company ID value.

  • Example format: SFPART123456

​
Registering a New OAuth2 Client Application

To use OAuth 2.0 authentication with SAP SuccessFactors, you need to register an OAuth2 client application in the Admin Center.

1

Access Manage OAuth2 Client Applications

In the upper right search bar, search for Manage OAuth2 Client Applications and select the option under Actions.

2

Register Client Application

Click Register Client Application.

3

Enter Application Details

Enter an Application Name (e.g., StackOne) and an Application URL.

  • Note: The Application URL can be any valid URL and is not used in this integration
  • Click Register to create the application

​
Generating X.509 Certificate

SAP SuccessFactors uses X.509 certificate-based authentication for OAuth2. SAP will generate the certificate for you.

1

Generate Certificate in SAP

In the OAuth2 Client Application registration screen, click the Generate X.509 Certificate button.

  • Enter any Common Name (CN) for the certificate (e.g., StackOne OAuth2)
  • Click Generate
2

Copy the Certificate

After generation, copy the entire value displayed in the X.509 Certificate section.

  • This is your x509 Certificate value — store it securely for use later

​
Downloading Private Key

The private key is required for signing authentication requests.

1

Download Private Key File

After generating the certificate, click the Download button.

  • ⚠️ Caution: The downloaded file contains your private key — handle it securely
2

Extract Private Key Content

Open the downloaded file and locate the private key content.

  • Copy only the long string of characters between -----BEGIN ENCRYPTED PRIVATE KEY----- and -----END ENCRYPTED PRIVATE KEY-----
  • Do not include the BEGIN/END markers themselves
  • This value is your Private Key — store it securely for use later

​
Finding API Key

The API Key (also called Client ID) is required for OAuth2 authentication.

1

Locate API Key

Your API Key is displayed on the Manage OAuth2 Client Applications screen above your X.509 Certificate.

  • Note: Copy this value immediately as it may not be shown again
  • Store it securely for use later

​
Configure OData API Permissions

Ensure the OAuth2 application has proper permissions to access OData API entities.

1

Access OData API Dictionary

Navigate to Admin Center > Company Settings > OData API Data Dictionary.

2

Enable Required Entities

Verify that the entities you need to access are enabled for OData API.

  • Check that entities like Employee, Candidate, JobRequisition, JobApplication are enabled
  • Ensure the OAuth2 client has appropriate read/write permissions
  • Enable Upsert operations if you need to update records (optional, not available in all instances)

​
Password (optional - for Skills/Competencies actions only)

The Password field is optional and only required if you intend to use the Skills or Competencies actions. These actions use HTTP Basic Auth instead of OAuth2, because SAP SuccessFactors exposes these entities through a different API path that does not support SAML2 bearer tokens.

1

Identify your password

The password is your SAP SuccessFactors user account login password — the same password you use to sign in to the web interface.

  • This is the password for the user identified by the Username field you configured earlier
  • Authentication is sent as Basic Auth using the format: username@companyId / password
  • Example: if your username is jsmith and company ID is SFPART123456, the Basic Auth username is jsmith@SFPART123456
2

When to leave this blank

Leave the Password field empty if you are not using Skills or Competencies actions.

  • All other HRIS, Recruiting, Learning, and Time actions authenticate using the OAuth2 credentials configured above
  • The password field will be ignored for all non-Skills/Competencies actions

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • API Server
  • Learning Domain URL (Optional)
  • Company ID
  • API Key
  • Username
  • Password (Optional)
  • Private Key
  • x509 Certificate
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account in your Accounts page.