Apply OAuth 2.0 Policy Between External Consumer and BTP API Management

Enable OAuth 2.0 authentication at the SAP BTP API Management layer to secure external access. Internally, API Management continues to call the SAP backend using Basic Authentication stored in Key Value Maps. To support this hybrid model, add a policy that removes the OAuth token from the request context after verification, ensuring clean forwarding to the backend.

To add policy to remove OAuth token:

  1. Select API proxy and click Policies.
  2. Click Edit.
  3. Select ProxyEndpoint.
  4. Select PreFlow.
  5. Under Mediation Policies, choose Assign Message.
  6. Click on the + button to add the policy.
  7. Enter the Policy Name, set the Stream as Incoming Request and click Add.
  8. Replace the existing default content in the Body section with the following policy XML, and click Update.
    Policy Message:
    <!-- This policy can be used to create or modify the standard HTTP request and response messages -->
<AssignMessage async="false" continueOnError="true" enabled="true" xmlns='http://www.sap.com/apimgmt'>
    <Remove>  
      <Headers>      
<Header name="Authorization"></Header>  
          </Headers>
     </Remove>
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
<AssignTo createNew="false" type="request"></AssignTo>
</AssignMessage>
  9. Click Save.