There are three main OAuth patterns for Joule Agents on SAP BTP. The right one depends on your scenario:

Pattern 1: OAuth2ClientCredentials (Most Common — IAS-Secured Agent)

Step 1: Register an Application in IAS

1. Go to your SAP Cloud Identity Services (IAS) admin console — navigate to https://<your-tenant>.accounts.ondemand.com/admin
2. Under Applications & Resources → Applications, click Add.
3. Name the application (e.g. MyJouleAgent) and select OpenID Connect.
4. Navigate to Client Authentication and create a new client secret. Note down:

• Client ID
• Client Secret
• Token endpoint: https://<your-tenant>.accounts.ondemand.com/oauth2/token

Step 2: Secure Your Agent Endpoint

Your agent (deployed on Cloud Foundry or Kyma) must validate the incoming JWT token issued by IAS. In a CAP-based agent, bind IAS using the Identity service:

# mta.yaml (service binding)

resources:

  – name: my-ias-service

    type: org.cloudfoundry.managed-service

    parameters:

      service: identity

      service-plan: application

In package.json, configure CAP to use IAS auth:

{

  “cds”: {

    “requires”: {

      “auth”: “ias”

    }

  }

}

Step 3: Create a BTP Destination in the Joule Subaccount

1. Open SAP BTP Cockpit → your Joule subaccount.
2. Navigate to Connectivity → Destinations → New Destination.
3. Fill in:

Field Value

Click Save, then Check Connection to validate.

Step 4: Reference the Destination in Your Joule Agent Config

In Joule Studio (Agent Builder), reference the destination by name when adding the tool/capability pointing to your agent endpoint. The destination name must match exactly.

Pattern 2: OAuth2JWTBearer (User Identity Propagation into S/4HANA)

Use this when Joule needs to call a backend (e.g. S/4HANA) and the downstream system must know which user initiated the request.

Step 1: Create a Proxy Application in IAS

1. In IAS admin console, create a new application — call it A2A_Proxy_App.
2. Under Client Authentication, create a new client secret. Note down the Client ID and Client Secret.

Step 2: Configure Trust Between IAS and the Target System

In the BTP subaccount of the target system, establish trust with the IAS tenant under Security → Trust Configuration.

Step 3: Create the BTP Destination

Name=BUSINESS_PARTNER_AGENT

Type=HTTP

URL=<your-agent-url>

ProxyType=Internet

Authentication=OAuth2JWTBearer

clientId=<A2A_Proxy_App client ID>

clientSecret=<A2A_Proxy_App client secret>

tokenServiceURL=https://<your-ias-tenant>/oauth2/token

The JWT Bearer flow exchanges the inbound user token from Joule for a new token scoped to the target system — carrying the user's identity forward. Source

Pattern 3: MCP Server in Joule Studio

If you are registering an MCP server as a tool for a Joule agent, add one extra destination property:

Name=MY_MCP_SERVER

Type=HTTP

URL=https://<your-mcp-server>.cfapps.<region>.hana.ondemand.com

ProxyType=Internet

Authentication=OAuth2ClientCredentials

Client ID=<Client ID>

Client Secret=<Client Secret>

Token Service URL=https://<your-tenant>.accounts.ondemand.com/oauth2/token

sap-joule-studio-mcp-server=true

Then in Joule Studio → Agent Builder → Tools, add the MCP server by referencing this destination. Source

Common Pitfalls

Problem Fix

Which Pattern Should You Use?

• Building a new agent and Joule calls it → OAuth2ClientCredentials with IAS
• Your agent calls S/4HANA or another system on behalf of the user → OAuth2JWTBearer
• Exposing tools via MCP protocol → OAuth2ClientCredentials + sap-joule-studio-mcp-server=true

Key references:

• Joule A2A: Secure Code Based Agents with IAS
• Joule A2A: User Identity Propagation