# Business Central OAuth 2.0 Token Request and API Call Generator

> Source: https://netray.co/tools/business-central-oauth-token-request-generator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Builds the client credentials token request for Business Central online plus sample REST and OData calls using the returned token.

## Category

developer

## Erp

Microsoft Dynamics 365 Business Central

## Audience

- Integration developer
- BC developer
- BC administrator

## Tool

**Kind:** template

**Output:** code

**Language:** http

**Fields:**

#### Microsoft Entra tenant ID

**Key:** tenant_id

**Type:** text

**Default:** 00000000-0000-0000-0000-000000000000

#### Application (client) ID

**Key:** client_id

**Type:** text

**Default:** 11111111-1111-1111-1111-111111111111

#### Client secret

**Key:** client_secret

**Type:** text

**Default:** YOUR_CLIENT_SECRET

**Help:** Never paste a real secret into a shared page

#### Environment name

**Key:** environment

**Type:** text

**Default:** Production

#### Company ID (GUID)

**Key:** company_id

**Type:** text

**Default:** 22222222-2222-2222-2222-222222222222

#### Company name for OData

**Key:** company_name

**Type:** text

**Default:** CRONUS USA, Inc.

**Blocks:**

#### 1. Request an access token

**Body:** POST https://login.microsoftonline.com/{{tenant_id}}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id={{client_id}}&client_secret={{client_secret}}&scope=https%3A%2F%2Fapi.businesscentral.dynamics.com%2F.default

#### 2. List companies with the standard API

**Body:** GET https://api.businesscentral.dynamics.com/v2.0/{{tenant_id}}/{{environment}}/api/v2.0/companies
Authorization: Bearer ACCESS_TOKEN_FROM_STEP_1
Accept: application/json

#### 3. Read items for one company

**Body:** GET https://api.businesscentral.dynamics.com/v2.0/{{tenant_id}}/{{environment}}/api/v2.0/companies({{company_id}})/items?$top=10
Authorization: Bearer ACCESS_TOKEN_FROM_STEP_1
Accept: application/json

#### 4. Call a published web service with OData V4

**Body:** GET https://api.businesscentral.dynamics.com/v2.0/{{tenant_id}}/{{environment}}/ODataV4/Company('{{company_name}}')/YourPublishedService?$top=10
Authorization: Bearer ACCESS_TOKEN_FROM_STEP_1
Accept: application/json

**Notes:** Before this works, register an application in Microsoft Entra ID, grant it the Dynamics 365 Business Central application permission with admin consent, and add the application on the Microsoft Entra Applications page in Business Central with suitable permission sets. In URLs, encode spaces and commas in the company name. Verify endpoint versions for your environment.

## Content

**Intro:** Server-to-server integrations with Business Central online use OAuth 2.0 client credentials through Microsoft Entra ID. This generator writes the token request and the first calls so you can test authentication quickly in a REST client.

**Sections:**

#### How to use the generator

**Body:** Enter your Entra tenant ID, the application's client ID and secret, the environment name and the company details. Copy the first block into a REST client such as Postman or the VS Code REST extension to get a token. Paste the token in the Authorization header of the next requests. The companies call is the quickest way to prove that the token, the environment and the permissions are correct.

**Bullets:**

- Use a test environment first
- Store secrets in a vault, not in code
- Tokens expire, so request a new one when you see 401

#### Setup in Entra and Business Central

**Body:** Register the application in Microsoft Entra ID, add API permissions for Dynamics 365 Business Central, choose Application permissions and grant admin consent. Create a client secret or certificate. Then, inside Business Central, open the Microsoft Entra Applications page, add the client ID, set the state to Enabled and assign permission sets. The application behaves like a user, so it can only do what its permission sets allow.

#### API versus OData web services

**Body:** The standard API v2.0 exposes entities such as companies, items, customers and sales orders in a stable format with etag handling for updates. OData V4 web services expose pages or queries that you publish from the Web Services page, so they can include your custom fields. Choose the API for stable integrations and OData for quick access to specific pages.

#### Common mistakes

**Body:** A 401 usually means the application is not added in Business Central or has no permission sets. A 403 can mean the permission sets are too narrow. A wrong environment name returns 404. People also mistake delegated permissions for application permissions, which produces token errors in service scenarios. Finally, do not share the client secret in chat or tickets, rotate it if exposed.

**Cta:** If you want an AI assistant to read Business Central data safely, we can build a read-only layer that shows the query and respects permissions.

**Faq:**

#### Why does Business Central return 401 with a valid token?

**Answer:** The token proves identity to Microsoft Entra, but Business Central also needs the application registered on its Microsoft Entra Applications page in the company, enabled, and assigned permission sets. Check those first, then the environment name in the URL.

#### Can I use basic authentication instead?

**Answer:** For Business Central online, basic authentication with user name and web service access key has been retired in favor of OAuth. Use OAuth 2.0 for new integrations. On-premises servers can still be configured differently.

#### What scope should I use?

**Answer:** For client credentials the scope is the Business Central resource followed by .default, as in the generated request. The .default scope returns the application permissions that were consented in Entra for that app.

#### Does the company name in OData need encoding?

**Answer:** Yes. Company names with spaces, commas or special characters should be URL encoded, and the single quotes around the name are part of the OData syntax. The API v2.0 route avoids this by using the company GUID.

## Search terms

business central oauth client credentials, business central api authentication, business central get access token, business central api.businesscentral.dynamics.com, business central service to service authentication, business central entra application setup, business central odata v4 call

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json