On Access token In SAP Business One, this is an authorization token that an application sends to the service layer with every request instead of logging in by calling a login function. The Authentication Server generates the access token and the service layer checks it.
Exhibition
The application receives the access token at the token endpoint of the authentication server. Depending on the client type, it uses the Authorization Code (with PKCE) or Client Credentials for machine-to-machine services (daemon) method. The response includes the access token as well as the validity period. Web and desktop applications additionally receive a refresh token for renewal. In the daemon process, there is no refresh token: the application requests a new access token after an error 401.
Utilisation
The application sends the access token in the Authorization header as a bearer token along with the client ID. The service layer checks the token against the authentication server. Subsequently, it compares the roles and permissions of the token with the permissions model of SAP Business One. Starting with Feature Package 2602, the client ID of the service layer must be included in the token’s Audience Claim. The DI API can also connect using the access token, but not for a user of a daemon service.
Error images
The status code 401 means that authentication is missing or invalid. Possible causes are a faulty token, a missing user binding, or a session timeout. The status code 403 means that the identity is known, but the object authorization is missing. In this case, the administrator checks the end user’s permissions in SAP Business One.
Reference to SAP Business One
Access tokens also play a role in webhooks. If a webhook subscription uses the OAuth authentication method, each notification includes an access token. The example project for the Model Context Protocol from Feature Package 2608 also relies on access tokens. If the service layer denies access, the example server does not return any data.
Demarcation
The access token replaces the login call and the session cookie in this way. The refresh token, on the other hand, is not an access token: it is used to obtain a new access token.
Shopware 6 for SAP Business One
SAP Business One and DATEV - Synchronised
DATEV and SAP Business One Export & Import
Electronic invoices to authorities
SAP Business One Connect for carriers
