Choosing the Right Authorization Method in SAP Integration Suite

[StefanK]

Hi everyone,

I'm curious to know which authorization methods you prefer when working with the SAP Integration Suite, including OAuth, Basic Authentication, and Client Certificate Authentication. I've noticed that using Client Certificate Authentication can be more complex due to the need to update certificates with all communication partners every 365 days.

Given these considerations, do you have recommendations or best practices to share? Additionally, does SAP provide any guidance on preferred authorization methods for specific scenarios?

Looking forward to hearing your insights!

Thanks!

Kind regards,

Stefan

[Punith_Oswal]

Hello Stephan,

SAP generally advises:

Use OAuth 2.0 whenever supported by the external system — especially for public APIs or cloud apps.

Use Client Certificates when strong mutual authentication is required and both parties support it, typically in B2B or On-Premise scenarios.

Use Basic Auth only when other options are not possible, and only over HTTPS with frequent password rotation.

Hope this helps!

Thanks,

Punith Oswal

[StefanK]

Thank you for the quick response. I have three questions regarding this:

1. If I create a service key for OAuth authentication, can I use the ClientID and Client Secret for Basic Authentication as well? Can I disable this option?

2. Do I always need to share the .pem and .key files with external partners when using Client Certificate?

3. When connecting SOAP services via SOAMANAGER to the Integration Suite, do I only have the option to authenticate using Basic Authentication and Client Certificate? Is OAuth not supported here?