Auth options for using SAP Concur API (for Expense reports)

[Vitalii]

Hi Community! 

I’ve been investigating SAP Concur authentication and want to confirm my understanding.

I am developing a service that provides SAP Concur customers with access to their expense data. Ideally, users would be able to authenticate using a standard OAuth flow with their SAP Concur credentials and automatically connect to their account, without requiring additional configuration on the customer’s Concur tenant. The developed service should fetch expense reports not only of the author, the user who was authenticated, but reports of other users - to be reviewed by the authenticated user ("approver"/"processor").

However, first of all, based on my current understanding, some level of tenant-side configuration or administrative approval may still be required. In the standard setup, OAuth applications are typically created within each customer’s tenant, which means each customer needs to configure the integration separately. This does not align well with a single global integration model on our side.

There seem to be two main approaches:

1. Partner application model — where a single OAuth client can be used across multiple customers, but this requires being registered as a Concur partner.

2. Company-level authentication — which allows backend/system-level access to company data and works better with a single integration architecture, but still requires per-customer setup.

Additionally, API access to data across multiple users appears to require elevated roles (such as administrative or web services roles). Regular users, even with roles like expense processor or reviewer, typically cannot retrieve other users’ data via API.

So overall:

• Per-customer configuration seems unavoidable

• Cross-user data access requires elevated privileges

• There is a trade-off between scalability (partner model) and simplicity (company-level auth)

Could you confirm whether this understanding is correct, and whether there are recommended best practices for multi-tenant SaaS integrations?

Thanks,

Vitalii

[KevinD]

@Vitalii I'm asking my API person about this. Hopefully he will have some insight.

[TChapman]

You are correct in that understanding.

1) As a user, the user would need to authenticate and most clients use SSO so there is no method available there.  Even so, it would be restricted to the authority level of the employee and not allow any data privacy issues.

2) As a company - This is the most likely route.  A client could provide you with the "keys" for your application to work (client id, sercret and tokens).  Then your application would behave "on belalf" of the client.  This requires additional purchases.

3) As a partner - This allows you access across companies however, clients need to "opt-in" before you can access their data.  Behind the scenes I don't know what data is passed for Concur to know that you are blessed....it might be the same thing...a client secret for your id or something like that.  Either way, you have to be a partner with appropriate contracts in place.

[Vitalii]

Hello TChapman, thank you for your response.

Could you please elaborate on what you meant by “this requires additional purchases”? Who would need to make these purchases, and what exactly would need to be purchased?

Is this typically a significant effort - such as a complex procurement process - or is it more of a straightforward add-on? Also, is it generally considered expensive?