Developer ToolsFree generatorPDF, Excel, Word exportMicrosoft Dynamics 365 Business Central

Business Central OAuth 2.0 Token Request and API Call Generator

Server-to-server integrations with Business Central online use OAuth 2.0 client credentials through Microsoft Entra ID. This generator writes the token request and the first calls so you can test authentication quickly in a REST client.

Fill in

Microsoft Entra tenant ID

Application (client) ID

Client secret

Never paste a real secret into a shared page

Environment name

Company ID (GUID)

Company name for OData

Generated code

Download:

1. Request an access token

POST https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=11111111-1111-1111-1111-111111111111&client_secret=YOUR_CLIENT_SECRET&scope=https%3A%2F%2Fapi.businesscentral.dynamics.com%2F.default

2. List companies with the standard API

GET https://api.businesscentral.dynamics.com/v2.0/00000000-0000-0000-0000-000000000000/Production/api/v2.0/companies
Authorization: Bearer ACCESS_TOKEN_FROM_STEP_1
Accept: application/json

3. Read items for one company

GET https://api.businesscentral.dynamics.com/v2.0/00000000-0000-0000-0000-000000000000/Production/api/v2.0/companies(22222222-2222-2222-2222-222222222222)/items?$top=10
Authorization: Bearer ACCESS_TOKEN_FROM_STEP_1
Accept: application/json

4. Call a published web service with OData V4

GET https://api.businesscentral.dynamics.com/v2.0/00000000-0000-0000-0000-000000000000/Production/ODataV4/Company('CRONUS USA, Inc.')/YourPublishedService?$top=10
Authorization: Bearer ACCESS_TOKEN_FROM_STEP_1
Accept: application/json

Before this works, register an application in Microsoft Entra ID, grant it the Dynamics 365 Business Central application permission with admin consent, and add the application on the Microsoft Entra Applications page in Business Central with suitable permission sets. In URLs, encode spaces and commas in the company name. Verify endpoint versions for your environment.

Integration design review

Optionally ask for a short review of your Business Central integration approach and security model.

Optional. The tool and every export work without this. No spam.

How to use the generator

Enter your Entra tenant ID, the application's client ID and secret, the environment name and the company details. Copy the first block into a REST client such as Postman or the VS Code REST extension to get a token. Paste the token in the Authorization header of the next requests. The companies call is the quickest way to prove that the token, the environment and the permissions are correct.

Use a test environment first
Store secrets in a vault, not in code
Tokens expire, so request a new one when you see 401

Setup in Entra and Business Central

Register the application in Microsoft Entra ID, add API permissions for Dynamics 365 Business Central, choose Application permissions and grant admin consent. Create a client secret or certificate. Then, inside Business Central, open the Microsoft Entra Applications page, add the client ID, set the state to Enabled and assign permission sets. The application behaves like a user, so it can only do what its permission sets allow.

API versus OData web services

The standard API v2.0 exposes entities such as companies, items, customers and sales orders in a stable format with etag handling for updates. OData V4 web services expose pages or queries that you publish from the Web Services page, so they can include your custom fields. Choose the API for stable integrations and OData for quick access to specific pages.

Common mistakes

A 401 usually means the application is not added in Business Central or has no permission sets. A 403 can mean the permission sets are too narrow. A wrong environment name returns 404. People also mistake delegated permissions for application permissions, which produces token errors in service scenarios. Finally, do not share the client secret in chat or tickets, rotate it if exposed.

Frequently Asked Questions

Why does Business Central return 401 with a valid token?

The token proves identity to Microsoft Entra, but Business Central also needs the application registered on its Microsoft Entra Applications page in the company, enabled, and assigned permission sets. Check those first, then the environment name in the URL.

Can I use basic authentication instead?

For Business Central online, basic authentication with user name and web service access key has been retired in favor of OAuth. Use OAuth 2.0 for new integrations. On-premises servers can still be configured differently.

What scope should I use?

For client credentials the scope is the Business Central resource followed by .default, as in the generated request. The .default scope returns the application permissions that were consented in Entra for that app.

Does the company name in OData need encoding?

Yes. Company names with spaces, commas or special characters should be URL encoded, and the single quotes around the name are part of the OData syntax. The API v2.0 route avoids this by using the company GUID.

If you want an AI assistant to read Business Central data safely, we can build a read-only layer that shows the query and respects permissions.

Talk to an Expert Explore More Free Tools

Related Tools

Developer Tools

More Developer Tools tools

See all

Back to All Tools