SAP Authentication with ODATA services

SAP ODATA service Authentication is a two step process

Step 1 - Get token

1. Make a GET request to the service URL
2. Make sure Authentication is set as Basic and username and Password are passed
3. Set a header "X-CSRF-Token" with value "Fetch"
4. Send the request to SAP
5. Examine the response headers
6. You should see a header "X-CSRF-Token"
7. Get the value from this header

This token value is typically valid for 30 mins

Step 2: Send request with token

1. Change GET to POST (if you are sending a payload to SAP ODATA Service)
2. Authentication is set as Basic and username and Password are passed
3. Set a header "X-CSRF-Token" and value received from last step
4. Send the POST request

You may get "CSRF token validation failed" if CSRF validation is enabled (in SAP) and the token is not send in header.


Below shows the same steps as done via Postman

Getting the token in Postman

1. Use a GET request to the Service URL
2. Set header "X-CSRF-Token"
3. Set value as "Fetch"
4. Hit Send
5. Examine the response headers 
6. Pick the value for "X-CSRF-Token"

 Using the token for a service request

1. Change service to POST
2. In header, set "X-CSRF-Token" to value from last reponse header value
3. Set the payload body and submit request