Skip to main content

SAP Sales Cloud (C4C) Integration: Setup and Security Overview

How to connect SAP Sales Cloud (C4C) to Bliro step by step, plus the security details IT teams ask about.

Written by Christian Angerer

This guide shows how to connect Bliro to SAP Sales Cloud (also called SAP Cloud for Customer or C4C). It is for the Bliro admin and the SAP admin who set it up together, and for IT teams reviewing security.

How it works

  • A Bliro admin connects SAP once for the whole organization. Members don't sign in to SAP themselves.

  • Bliro acts as each member's own SAP user. It finds that user by email address.

  • SAP applies that user's permissions to every request. Bliro can only see and do what the user can in SAP.

  • Bliro proves who it is with a key pair. Bliro keeps the private key and signs each request with it. SAP checks the signature with the matching certificate.

Before you start

You need:

  • A Bliro organization admin.

  • An SAP admin with access to the Administrator work center in C4C.

  • For every member who should use SAP: a Business User in SAP with the same email address as in Bliro. Capitalization doesn't matter.

Setup goes back and forth between Bliro and SAP. The Bliro admin keeps the Bliro dialog open from Step 1 to Step 6.

Step

Who

1. Generate the key pair

Bliro admin

2. Register Bliro as identity provider

SAP admin

3. Register the OAuth client

SAP admin

4. Choose scopes

SAP admin

5. Check user access

SAP admin

6. Enter the details and connect

Bliro admin

7. Allow tools and test

Bliro admin

Step 1 - Generate the key pair (Bliro)

  1. In Bliro, go to Integrations → SAP and open the connection dialog.

  2. Click Generate New Key Pair. Bliro fills in the Private key field and downloads bliro-sap-signing.cer.

  3. Send the .cer file to your SAP admin. Never send the private key to anyone, including SAP and Bliro support.

Keep this dialog open until you click Connect in Step 6. The key is only saved when you connect. If you close or refresh the page, the key is lost and SAP needs a new certificate. Download certificate again only works while the dialog is open.

The certificate is valid for 1,095 days (3 years). The dialog shows the expiry date. Bliro doesn't remind you, so note the date. To renew, see Replacing the signing key.

If your company must create keys itself, see Using your own key.

Step 2 - Register Bliro as identity provider (SAP)

This tells SAP to trust Bliro's certificate.

  1. Go to Administrator → Common Tasks → Configure OAuth 2.0 Identity Provider.

  2. Create a new identity provider.

  3. Issuer Name: enter a name, for example Bliro-API-App. Bliro needs the exact same value in Step 6.

  4. Upload bliro-sap-signing.cer.

  5. Under Name Identifier Formats, turn on E-Mail Address and User Account ID. SAP uses the email address to find the matching user.

Step 3 - Register the OAuth client (SAP)

This creates the credentials Bliro uses to request access.

  1. Go to Administrator → Common Tasks → OAuth 2.0 Client Registration and click New.

  2. SAML Issuer: select the identity provider from Step 2.

  3. Token Lifetime: 3600 seconds (1 hour).

  4. Save. Note the Client ID (for example _1829727704O) and the Client Secret.

Step 4 - Choose scopes (SAP)

Scopes decide which areas of SAP Bliro can reach. In the client from Step 3, under Registered Scopes, select:

Scope

Covers

Needed

UIWC:CC_HOME

General access

Always

UIWC:CODACCOUNTWC

Corporate accounts

Typical

UIWC:CODPARTNERWC

Partners

Typical

UIWC:CODPEOPLE

People and contacts

Typical

UIWC:COD_ACTIVITIES

Activities (visits, calls, tasks)

Typical

Only add what your team needs.

Step 5 - Check user access (SAP)

For each member who will use SAP through Bliro:

  1. Go to Administrator → User Management → Business Users.

  2. Find the user by the email address they use in Bliro.

  3. Open Access Rights → Work Center and View Assignments.

  4. Check they have the work centers for the scopes from Step 4 (for example CODACCOUNTWC for accounts).

Members without a matching email or the right work centers get an error when Bliro tries to reach SAP for them.

Step 6 - Enter the details and connect (Bliro)

Back in the open dialog, fill in:

Field

Value

Tenant

Your C4C tenant subdomain, for example my370045-sso

Identity provider name

The Issuer Name from Step 2. Must match exactly.

Client ID

From Step 3

Client secret

From Step 3

OData scopes

The scopes from Step 4, separated by spaces or commas, for example UIWC:CC_HOME UIWC:CODACCOUNTWC UIWC:CODPEOPLE

Private key

Already filled in from Step 1

Click Connect. The connection is now active for your whole organization.

Step 7 - Allow tools and test (Bliro)

Bliro does nothing in SAP until you allow it. Each action, like Read Account or Create Visit Report, is a tool with its own permission. Set them under Tools & Permissions. See AI Tools and Permissions. For repeatable workflows, see AI Skills.

Connect saves your settings but doesn't test them. To test, allow Read Account. Then, as a member with a matching SAP user, ask Bliro in chat to look up one of your SAP accounts. If Bliro finds it, you're done.

If it fails, check:

  • The Identity provider name in Bliro matches the Issuer Name in SAP exactly.

  • SAP has the certificate from your latest key pair.

  • The member's email address is the same in Bliro and SAP.

Editing the connection

Open the SAP integration in Bliro, make your changes and click Save changes.

  • The client secret and private key show only as *****. Bliro never shows them again.

  • Leave them blank to keep them. You can change the tenant, identity provider name, client ID or scopes on their own.

  • A blank field never deletes a secret. Only Disconnect does.

  • Only one admin should edit credentials at a time.

Replacing the signing key

Do this before the certificate expires. It affects your whole organization. SAP access can fail between the change in SAP and saving in Bliro, so do the steps back to back.

  1. In Bliro, open Edit SAP C4C and click Generate New Key Pair. Keep the dialog open. The old key stays active until you save.

  2. Upload the new .cer file to the identity provider in SAP (Step 2).

  3. In Bliro, click Save changes.

  4. Test as in Step 7. Access tokens last up to an hour, so test again an hour later to be sure the new key works.

Cancelling in Bliro doesn't undo the change in SAP. Each click on Generate New Key Pair creates a different pair. Always upload the latest certificate.

Using your own key

If your company must create keys itself, run:

openssl req -x509 -newkey rsa:2048 -sha256 -days 1095 -nodes \
  -keyout bliro-sap-signing.key -out bliro-sap-signing.pem \
  -subj "/CN=Bliro-API-App"

openssl x509 -in bliro-sap-signing.pem -outform der \
  -out bliro-sap-signing.cer

  • Upload bliro-sap-signing.cer to SAP in Step 2.

  • In Step 6, paste the full content of bliro-sap-signing.key into Private key. It starts with -----BEGIN PRIVATE KEY-----. Never paste the certificate there.

  • Change -days for a different validity.

Security

  • Per-user access. Every request runs as the member's own SAP user. SAP applies their roles and restrictions. There is no shared technical user.

  • Audit trail. Every read and write appears in SAP's logs under that user.

  • Least privilege. Scopes cap what Bliro can reach. Each user's work centers restrict it further.

  • Any identity provider. Works with Microsoft Entra ID, SAP Cloud Identity Services, Okta or any other. Bliro signs requests and SAP checks them directly. Your identity provider is not involved.

  • Credentials. The client secret and private key are encrypted at rest and can't be downloaded again. Access tokens last about an hour. Bliro never stores SAP passwords.

  • Key generation. Only organization admins can generate keys. Nothing is stored until an admin saves. The private key is sent once, to the open dialog, and is not cached.

  • Protocol. OAuth 2.0 SAML Bearer Assertion (RFC 7522). All traffic is encrypted with HTTPS.

  • Key specification. RSA-2048, PKCS#8 private key, self-signed X.509 certificate with SHA-256, DER .cer, CN=Bliro-API-App. Signing only, not a certificate authority. The CN is not the SAML issuer. The issuer is the identity provider name from Step 2.

More in our trust center.

Disconnecting

  • In Bliro: click Disconnect on the SAP integration page. This deletes the client secret and private key and stops SAP access for everyone.

  • In SAP: delete the OAuth client (Administrator → Common Tasks → OAuth 2.0 Client Registration) or the identity provider (Administrator → Common Tasks → Configure OAuth 2.0 Identity Provider). To block one user, remove their work center assignments.

Questions? Contact [email protected].

Related Articles
Did this answer your question?