3796078 - Definitive Basic Authentication Deprecation for SuccessFactors APIs: Overview and Alternatives

At November 2027, SAP is permanently removing Basic Authentication (username + password) for API access and direct integrations with SAP SuccessFactors (SF).

SAP considers this method insecure and has been phasing it out in favor of token-based and certificate-based methods.

This article explains:

1. What Will Be Affected
   1. How to identify affected integrations
2. Available Authentication Alternatives
   1. OAuth 2.0 with SAML Bearer Assertion
   2. OpenID Connect (OIDC) via SAP Cloud Identity Services (IAS/IPS)
   3. X.509 Certificate-Based Authentication (mTLS)

1. What Will Be Affected

All integrations using Basic Authentication (username + password) to call SAP SuccessFactors APIs can be affected.

This does not affect integrations where SuccessFactors authenticates to external systems, only the reverse direction.

All Client systems (calling SF) must migrate to a modern, secure authentication method before the deletion dates in November 2027. After that date, Basic Authentication will no longer work.

For more details, refer to the What's New Viewer announcement: Deprecation of Basic Authentication for APIs | SAP Help Portal.

1.1 How to identify affected integrations

Engage the team responsible for managing your SuccessFactors integrations, typically hosted on middleware such as SAP Integration Suite (CPI) or other external systems.

If you are still unsure whether all integrations have been identified, you can contact SAP Support (manually select LOD-SF-INT) and request a report showing Client system IPs and API requests reaching SuccessFactors servers via Basic Authentication. Just note the information available in the server internal logs is limited.

Note for Technical Support: See internal notes.

SAP SuccessFactors HCM Suite

KBA , LOD-SF-INT-ODATA , OData API Framework , LOD-SF-INT-API , API & Adhoc API Framework , LOD-SF-INT-EC , Employee Central SFAPI & OData Entities , LOD-SF-INT-CE , Compound Employee API , Problem