> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect SAP SuccessFactors with OAuth 2.0 – StackOne Hub

> Link a SAP SuccessFactors account in the StackOne Hub using OAuth 2.0. End-user guide to authorize the integration and start using SAP SuccessFactors actions.

<Warning>Ensure you have Admin privileges for your SAP SuccessFactors account with permission for the Manage Integration Tools > Manage OAuth2 Client Applications.</Warning>

<section data-guide-section data-guide-scopes="">
  <h2>Locating API Server</h2>

  <p>SAP uses multiple API server addresses. You will need to look up the API server that corresponds to your tenant domain.</p>

  <Steps>
    <Step title="Find Your API Server">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Navigate to the <a href="https://help.sap.com/docs/successfactors-platform/sap-successfactors-api-reference-guide-odata-v2/list-of-sap-successfactors-api-servers?locale=en-US" target="_blank" rel="noopener noreferrer">SAP API Server Table</a> and locate your tenant domain in the table.</p>

        <ul>
          <li>For example, if your domain is `https://pmsalesdemo8.successfactors.com/`, search for `salesdemo8` in the table</li>
          <li>Copy the value in the <strong>API Server</strong> column (remove the trailing forward-slash)</li>
          <li>Example: `https://apisalesdemo8.successfactors.com`</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Find your learning domain URL (optional - for Learning/OCN actions only)</h2>

  <p>Your learning domain URL is required only for Learning or OCN actions like course import and completion tracking. This is the user-facing URL, NOT the API server URL.</p>

  <Steps>
    <Step title="Locate learning domain URL">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Check your browser address bar when signed in to SAP SuccessFactors Learning.</p>

        <ul>
          <li>Navigate to the Learning module in SAP SuccessFactors.</li>
          <li>Look at the URL in your browser's address bar.</li>
          <li>Example: if your URL is `https://salesdemo8.successfactors.com/learning/admin`, your learning domain URL is `https://salesdemo8.successfactors.com`</li>
          <li>Copy the base URL (everything before `/learning`).</li>
        </ul>
      </div>
    </Step>

    <Step title="Understand the difference from API server URL">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>SAP SuccessFactors uses different URLs for Learning APIs versus HRIS APIs.</p>

        <ul>
          <li><strong>Learning domain URL</strong> (NO `api` prefix): `https://salesdemo8.successfactors.com` - for OCN/Learning actions</li>
          <li><strong>API server URL</strong> (HAS `api` prefix): `https://apisalesdemo8.successfactors.com` - for HRIS actions</li>
          <li>Notice: The API server URL typically has `api` added to the subdomain</li>
          <li>Both URLs use the same OAuth credentials.</li>
        </ul>
      </div>
    </Step>

    <Step title="Verify the format">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Ensure your learning domain URL follows the correct format.</p>

        <ul>
          <li>✅ Correct: `https://salesdemo8.successfactors.com`</li>
          <li>✅ Correct: `https://pmsalesdemo.successfactors.com`</li>
          <li>❌ Incorrect: `https://apisalesdemo8.successfactors.com` (this is the API server, not learning domain)</li>
          <li>❌ Incorrect: `https://salesdemo8.successfactors.com/learning` (remove `/learning` path)</li>
          <li>❌ Incorrect: `https://salesdemo8.successfactors.com/learning/admin` (remove all paths)</li>
          <li>Leave this field blank if you only use HRIS actions and don't need Learning module integration.</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Finding Username</h2>

  <p>Your username is required for authentication and can be found in your SAP SuccessFactors profile.</p>

  <Steps>
    <Step title="Locate Your Username">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Log in to SAP SuccessFactors and select your profile image in the upper right-hand corner of the screen.</p>

        <ul>
          <li>Your username is the value in parentheses next to your name</li>
          <li>Example: If you see 'John Smith (jsmith)', your username is `jsmith`</li>
          <li>Copy this value and note it as your <strong>Username</strong></li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Finding Company ID</h2>

  <p>The Company ID uniquely identifies your SAP SuccessFactors organization.</p>

  <Steps>
    <Step title="Access Version Information">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Within the same profile dropdown, select <strong>Show version information</strong>.</p>
      </div>
    </Step>

    <Step title="Copy Company ID">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>In the modal that appears, locate and copy the <strong>Company ID</strong> value.</p>

        <ul>
          <li>Example format: `SFPART123456`</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Registering a New OAuth2 Client Application</h2>

  <p>To use OAuth 2.0 authentication with SAP SuccessFactors, you need to register an OAuth2 client application in the Admin Center.</p>

  <Steps>
    <Step title="Access Manage OAuth2 Client Applications">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>In the upper right search bar, search for <strong>Manage OAuth2 Client Applications</strong> and select the option under Actions.</p>
      </div>
    </Step>

    <Step title="Register Client Application">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Click <strong>Register Client Application</strong>.</p>
      </div>
    </Step>

    <Step title="Enter Application Details">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Enter an Application Name (e.g., `StackOne`) and an Application URL.</p>

        <ul>
          <li>Note: The Application URL can be any valid URL and is not used in this integration</li>
          <li>Click <strong>Register</strong> to create the application</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Generating X.509 Certificate</h2>

  <p>SAP SuccessFactors uses X.509 certificate-based authentication for OAuth2. SAP will generate the certificate for you.</p>

  <Steps>
    <Step title="Generate Certificate in SAP">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>In the OAuth2 Client Application registration screen, click the <strong>Generate X.509 Certificate</strong> button.</p>

        <ul>
          <li>Enter any Common Name (CN) for the certificate (e.g., `StackOne OAuth2`)</li>
          <li>Click <strong>Generate</strong></li>
        </ul>
      </div>
    </Step>

    <Step title="Copy the Certificate">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>After generation, copy the entire value displayed in the <strong>X.509 Certificate</strong> section.</p>

        <ul>
          <li>This is your <strong>x509 Certificate</strong> value — store it securely for use later</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Downloading Private Key</h2>

  <p>The private key is required for signing authentication requests.</p>

  <Steps>
    <Step title="Download Private Key File">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>After generating the certificate, click the <strong>Download</strong> button.</p>

        <ul>
          <li>⚠️ Caution: The downloaded file contains your private key — handle it securely</li>
        </ul>
      </div>
    </Step>

    <Step title="Extract Private Key Content">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Open the downloaded file and locate the private key content.</p>

        <ul>
          <li>Copy only the long string of characters between `-----BEGIN ENCRYPTED PRIVATE KEY-----` and `-----END ENCRYPTED PRIVATE KEY-----`</li>
          <li>Do not include the BEGIN/END markers themselves</li>
          <li>This value is your <strong>Private Key</strong> — store it securely for use later</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Finding API Key</h2>

  <p>The API Key (also called Client ID) is required for OAuth2 authentication.</p>

  <Steps>
    <Step title="Locate API Key">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Your API Key is displayed on the <strong>Manage OAuth2 Client Applications</strong> screen above your X.509 Certificate.</p>

        <ul>
          <li>Note: Copy this value immediately as it may not be shown again</li>
          <li>Store it securely for use later</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Configure OData API Permissions</h2>

  <p>Ensure the OAuth2 application has proper permissions to access OData API entities.</p>

  <Steps>
    <Step title="Access OData API Dictionary">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Navigate to <strong>Admin Center</strong> > <strong>Company Settings</strong> > <strong>OData API Data Dictionary</strong>.</p>
      </div>
    </Step>

    <Step title="Enable Required Entities">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Verify that the entities you need to access are enabled for OData API.</p>

        <ul>
          <li>Check that entities like `Employee`, `Candidate`, `JobRequisition`, `JobApplication` are enabled</li>
          <li>Ensure the OAuth2 client has appropriate read/write permissions</li>
          <li>Enable Upsert operations if you need to update records (optional, not available in all instances)</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Password (optional - for Skills/Competencies actions only)</h2>

  <p>The Password field is optional and only required if you intend to use the Skills or Competencies actions. These actions use HTTP Basic Auth instead of OAuth2, because SAP SuccessFactors exposes these entities through a different API path that does not support SAML2 bearer tokens.</p>

  <Steps>
    <Step title="Identify your password">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>The password is your SAP SuccessFactors user account login password — the same password you use to sign in to the web interface.</p>

        <ul>
          <li>This is the password for the user identified by the <strong>Username</strong> field you configured earlier</li>
          <li>Authentication is sent as Basic Auth using the format: `username@companyId` / `password`</li>
          <li>Example: if your username is `jsmith` and company ID is `SFPART123456`, the Basic Auth username is `jsmith@SFPART123456`</li>
        </ul>
      </div>
    </Step>

    <Step title="When to leave this blank">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Leave the Password field empty if you are not using Skills or Competencies actions.</p>

        <ul>
          <li>All other HRIS, Recruiting, Learning, and Time actions authenticate using the OAuth2 credentials configured above</li>
          <li>The password field will be ignored for all non-Skills/Competencies actions</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<div data-whitelabel-hide>
  <h2>Linking the Account from the Hub</h2>

  <Steps>
    <Step title="Navigate to the Hub">
      Use one of the three <a href="/guides/accounts-section#linking-accounts">Linking Account Methods</a> to access the Hub.
    </Step>

    <Step title="Fill out the fields">
      Fill out the following fields using details from your provider:

      <ul>
        <li><strong>API Server</strong></li>
        <li><strong>Learning Domain URL</strong> (Optional)</li>
        <li><strong>Company ID</strong></li>
        <li><strong>API Key</strong></li>
        <li><strong>Username</strong></li>
        <li><strong>Password</strong> (Optional)</li>
        <li><strong>Private Key</strong></li>
        <li><strong>x509 Certificate</strong></li>
      </ul>
    </Step>

    <Step title="Connect">
      <ul>
        <li>Click <strong>Connect</strong></li>
        <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
        <li>Once authorization is successful, you will see a confirmation popup</li>
      </ul>
    </Step>
  </Steps>

  <p>If the account linking is successful, you will see the newly linked account in your <a href="/guides/accounts-section">Accounts</a> page.</p>
</div>