--- id: object/codeunit/501 type: object title: Codeunit 501 "OAuth2" summary: Codeunit 501 "OAuth2" in System Application (System.Security.Authentication). 39 public procedures. Present since at least BC23, still in BC30, changed in BC24, BC26-28. tier: official language: en tags: - codeunit - system application versions: introduced: null last_changed: "28" deprecated: null review: state: derived by: null at: null flags: [] generated: at: "2026-10-11T00:31:51.816Z" pipeline: 0.2.0 prompts: {} input_hash: bbc4320c02a87b97200dcfab84f6554878c1cb3148ae29efdfbd05b35f2d3916 evidence: - kind: code url: https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/OAuth2/OAuth2.Codeunit.al title: src/System Application/App/OAuth2/OAuth2.Codeunit.al (releases/29.x) date: null commit: ea08af5ef2d6a9b5c5af4a029288abbe2c883220 t: null quote: null links: learn: [] objects: [] features: [] topics: [] localizations: [] videos: [] posts: [] guidelines: [] object_type: codeunit object_id: 501 name: OAuth2 namespace: System.Security.Authentication app: System Application extends: null first_version: "23" last_version: "30" present_in: - "23" - "24" - "25" - "26" - "27" - "28" - "29" - "30" changed_in: - "24" - "26" - "27" - "28" source_major: "29" obsolete: null countries: [] ms_search_form_ids: [] counts: fields: 0 procedures: 39 events: 0 subscribers: 0 relations: out: 0 referenced_by: 0 pages: 0 extended_by: 0 event_subscribers: 0 calls: 1 called_by: 25 implements: 0 --- # Codeunit 501 "OAuth2" > Codeunit 501 "OAuth2" in System Application (System.Security.Authentication). 39 public procedures. Present since at least BC23, still in BC30, changed in BC24, BC26-28. System Application · System.Security.Authentication · BC23-30 · [source at ea08af5e](https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/OAuth2/OAuth2.Codeunit.al) · facts from BC29 ## Properties | Property | Value | |---|---| | Access | Public | ## Procedures - `AcquireTokenByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; ResourceURL: Text; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v1.0 code grant flow. - `AcquireTokenByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; ResourceURL: Text; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v1.0 code grant flow. - `AcquireTokenByAuthorizationCode(ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v2.0 code grant flow. - `AcquireTokenByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v2.0 code grant flow. - `AcquireTokenByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v2.0 code grant flow. - `AcquireTokensByAuthorizationCode(ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var IdToken: Text; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v2.0 code grant flow. - `AcquireTokensByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var IdToken: Text; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v2.0 code grant flow. - `AcquireTokensByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var IdToken: Text; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v2.0 code grant flow. - `AcquireTokenAndTokenCacheByAuthorizationCode(ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var TokenCache: Text; var Error: Text)`: Gets the access token and token cache state with authorization code flow. - `AcquireTokenAndTokenCacheByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var TokenCache: Text; var Error: Text)`: Gets the access token and token cache state with authorization code flow. - `AcquireTokenAndTokenCacheByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var TokenCache: Text; var Error: Text)`: Gets the access token and token cache state with authorization code flow. - `AcquireTokensAndTokenCacheByAuthorizationCode(ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var IdToken: Text; var TokenCache: Text; var Error: Text)`: Gets the access token and token cache state with authorization code flow. - `AcquireTokensAndTokenCacheByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var IdToken: Text; var TokenCache: Text; var Error: Text)`: Gets the access token and token cache state with authorization code flow. - `AcquireTokensAndTokenCacheByAuthorizationCodeWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; var AccessToken: SecretText; var IdToken: Text; var TokenCache: Text; var Error: Text)`: Gets the access token and token cache state with authorization code flow. - `AcquireOnBehalfOfToken(RedirectURL: Text; Scopes: List of [Text]; var AccessToken: SecretText)`: Gets the authentication token via the On-Behalf-Of OAuth2 v2.0 protocol flow. - `AcquireOnBehalfOfTokens(RedirectURL: Text; Scopes: List of [Text]; var AccessToken: SecretText; var IdToken: Text)`: Gets the authentication token via the On-Behalf-Of OAuth2 v2.0 protocol flow. - `RequestClientCredentialsAdminPermissions(ClientId: Text; OAuthAuthorityUrl: Text; RedirectURL: Text; var HasGrantConsentSucceeded: Boolean; var PermissionGrantError: Text)`: Request the permissions from a directory admin. - `AcquireTokenWithClientCredentials(ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; ResourceURL: Text; var AccessToken: SecretText)`: Gets the access token via the Client Credentials OAuth2 v1.0 grant flow. - `AcquireTokenWithClientCredentials(ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; var AccessToken: SecretText)`: Gets the access token via the Client Credentials OAuth2 v2.0 grant flow. - `AcquireAuthorizationCodeTokenFromCacheWithCertificate(ClientId: Text; Certificate: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; ResourceURL: Text; var AccessToken: SecretText)`: Gets the access token from cache or a refreshed token via OAuth2 v1.0 protocol. - `AcquireAuthorizationCodeTokenFromCacheWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; ResourceURL: Text; var AccessToken: SecretText)`: Gets the access token from cache or a refreshed token via OAuth2 v1.0 protocol. - `AcquireAuthorizationCodeTokenFromCache(ClientId: Text; ClientSecret: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText)`: Gets the access token from cache or a refreshed token via OAuth2 v2.0 protocol. - `AcquireTokensFromCache(ClientId: Text; ClientSecret: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText; var IdToken: Text)`: Gets the access token from cache or a refreshed token via OAuth2 v2.0 protocol. - `AcquireAuthorizationCodeTokenFromCacheWithCertificate(ClientId: Text; Certificate: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText)`: Gets the access token from cache or a refreshed token via OAuth2 v2.0 protocol. - `AcquireAuthorizationCodeTokenFromCacheWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText)`: Gets the access token from cache or a refreshed token via OAuth2 v2.0 protocol. - `AcquireTokensFromCacheWithCertificate(ClientId: Text; Certificate: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText; var IdToken: Text)`: Gets the access token from cache or a refreshed token via OAuth2 v2.0 protocol. - `AcquireTokensFromCacheWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText; var IdToken: Text)`: Gets the access token from cache or a refreshed token via OAuth2 v2.0 protocol. - `AcquireTokensWithCertificate(ClientId: Text; Certificate: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText; var IdToken: Text)`: Gets the access token via OAuth2 v2.0 protocol, authenticating as a service principal (as the app whose credentials you are providing). - `AcquireTokensWithCertificate(ClientId: Text; Certificate: SecretText; CertificatePassword: SecretText; RedirectURL: Text; OAuthAuthorityUrl: Text; Scopes: List of [Text]; var AccessToken: SecretText; var IdToken: Text)`: Gets the access token via OAuth2 v2.0 protocol, authenticating as a service principal (as the app whose credentials you are providing). - `AcquireOnBehalfAccessTokenAndTokenCache(OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; var AccessToken: SecretText; var TokenCache: Text)`: Gets the access and refresh token via the On-Behalf-Of OAuth2 v2.0 protocol flow. - `AcquireOnBehalfTokensAndTokenCache(OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; var AccessToken: SecretText; var IdToken: Text; var TokenCache: Text)`: Gets the access and refresh token via the On-Behalf-Of OAuth2 v2.0 protocol flow. - `AcquireOnBehalfOfTokenByTokenCache(LoginHint: Text; RedirectURL: Text; Scopes: List of [Text]; TokenCache: Text; var AccessToken: SecretText; var NewTokenCache: Text)`: Gets the token and token cache via the On-Behalf-Of OAuth2 v1.0 protocol flow. - `AcquireOnBehalfOfTokensByTokenCache(LoginHint: Text; RedirectURL: Text; Scopes: List of [Text]; TokenCache: Text; var AccessToken: SecretText; var IdToken: Text; var NewTokenCache: Text)`: Gets the token and token cache via the On-Behalf-Of OAuth2 v1.0 protocol flow. - `AcquireOnBehalfOfTokenByTokenCache(ClientId: Text; ClientSecret: SecretText; LoginHint: Text; RedirectURL: Text; Scopes: List of [Text]; TokenCache: Text; var AccessToken: SecretText; var NewTokenCache: Text)`: Gets the token and token cache via the On-Behalf-Of OAuth2 v1.0 protocol flow. - `AcquireOnBehalfOfTokensByTokenCache(ClientId: Text; ClientSecret: SecretText; LoginHint: Text; RedirectURL: Text; Scopes: List of [Text]; TokenCache: Text; var AccessToken: SecretText; var IdToken: Text; var NewTokenCache: Text)`: Gets the token and token cache via the On-Behalf-Of OAuth2 v1.0 protocol flow. - `AcquireAuthorizationCode(ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; Scopes: List of [Text]; PromptInteraction: Enum "Prompt Interaction"; Audience: Text; var AuthCode: Text; var AuthCodeErr: Text)`: Gets the authorization token based on the authorization code via the OAuth2 v2.0 code grant flow. - `GetClaims(JWT: SecretText): JsonObject`: Gets the Claims Set from a JSON Web Token (JWT). - `GetLastErrorMessage(): Text`: Get the last error message that happened during acquiring of an access token. - `GetDefaultRedirectURL(var RedirectUrl: Text)`: Returns the default Business Central redirectURL ## Calls From the extracted call graph of BC29 (graphify-al on the snapshot checkout): calls whose target is known from a declared type or an `Object::"Name"` argument. Interface dispatch and calls through events are not counted, so the list is not complete. - [Codeunit 502 "OAuth2Impl"](../codeunit/502.md) (25 calls: `AcquireAuthorizationCode → AcquireAuthorizationCode`, `AcquireAuthorizationCodeTokenFromCache → AcquireTokenFromCache`, `AcquireAuthorizationCodeTokenFromCacheWithCertificate → AcquireTokenFromCacheWithCertificate`, …) ## Called by - [Codeunit 7201 "CDS Integration Impl."](../codeunit/7201.md) (8 calls: `GetAccessToken → AcquireAuthorizationCodeTokenFromCache`, `GetAccessToken → AcquireAuthorizationCodeTokenFromCacheWithCertificate`, `GetAccessToken → AcquireTokenByAuthorizationCode`, …) - [Codeunit 4507 "Email - OAuth Client"](../codeunit/4507.md) (7 calls: `AuthorizationCodeTokenCacheExists → AcquireAuthorizationCodeTokenFromCache`, `GetLastAuthorizationErrorMessage → GetLastErrorMessage`, `Initialize → GetDefaultRedirectURL`, …) - [Codeunit 7203 "CDS Environment"](../codeunit/7203.md) (6 calls: `GetGlobalDiscoverabilityOnBehalfTokenAsSecretText → AcquireOnBehalfOfToken`, `GetGlobalDiscoverabilityToken → AcquireAuthorizationCodeTokenFromCache`, `GetGlobalDiscoverabilityToken → AcquireAuthorizationCodeTokenFromCacheWithCertificate`, …) - [Codeunit 102 "Import Consolidation from API"](../codeunit/102.md) (4 calls: `GetToken → AcquireAuthorizationCodeTokenFromCache`, `GetToken → AcquireAuthorizationCodeTokenFromCacheWithCertificate`, `GetToken → AcquireTokensByAuthorizationCode`, …) - [Codeunit 4700 "VAT Group Communication"](../codeunit/4700.md) (4 calls: `GetBearerToken → AcquireTokenByAuthorizationCode`, `GetBearerToken → AcquireTokenByAuthorizationCodeWithCertificate`, `GetBearerTokenFromCache → AcquireAuthorizationCodeTokenFromCache`, …) - [Codeunit 1686 "Email Logging OAuth Client"](../codeunit/1686.md) (3 calls: `AuthorizationCodeTokenCacheExists → AcquireAuthorizationCodeTokenFromCache`, `GetLastErrorMessage → GetLastErrorMessage`, `TryGetAccessTokenInternal → AcquireOnBehalfOfToken`) - [Codeunit 9510 "Document Service Management"](../codeunit/9510.md) (3 calls: `GetAccessToken → AcquireAuthorizationCodeTokenFromCache`, `GetAccessToken → AcquireTokenByAuthorizationCode`, `InitializeDefaultService → GetDefaultRedirectURL`) - [Codeunit 560 "CrossIntercompany Connector"](../codeunit/560.md) (2 calls: `AcquireBearerAccessToken → AcquireTokenWithClientCredentials`, `AcquireBearerAccessToken → GetDefaultRedirectURL`) - [Codeunit 7247 "MDM Http Source Transport"](../codeunit/7247.md) (2 calls: `AcquireToken → AcquireTokenWithClientCredentials`, `TryAcquireTokenFromCache → AcquireAuthorizationCodeTokenFromCache`) - [Codeunit 9144 "SharePoint Authorization Code"](../codeunit/9144.md) (2 calls: `AcquireToken → AcquireAuthorizationCodeTokenFromCache`, `AcquireToken → AcquireTokenByAuthorizationCode`) - [Page 7201 "CDS Connection Setup Wizard"](../page/7201.md) (2 calls: `GetCDSEnvironment → AcquireOnBehalfOfToken`, `OnOpenPage → GetDefaultRedirectURL`) - [Codeunit 1410 "Doc. Exch. Service Mgt."](../codeunit/1410.md) (1 call: `GetDefaultRedirectUrl → GetDefaultRedirectURL`) - [Codeunit 1681 "Email Logging Management"](../codeunit/1681.md) (1 call: `PromptClientCredentials → GetDefaultRedirectURL`) - [Codeunit 2020 "Image Analysis Management"](../codeunit/2020.md) (1 call: `TryAcquireOAuth2Token → AcquireTokensWithCertificate`) - [Codeunit 4516 "OAuth2 SMTP Authentication"](../codeunit/4516.md) (1 call: `AuthenticateWithOAuth2CustomAppReg → RequestClientCredentialsAdminPermissions`) - [Codeunit 6904 "Expense OAuth Client"](../codeunit/6904.md) (1 call: `GetAccessToken → AcquireOnBehalfOfToken`) - [Codeunit 6941 "EA Http Client"](../codeunit/6941.md) (1 call: `TryGetAccessToken → AcquireOnBehalfOfToken`) - [Codeunit 7802 "Azure Functions OAuth2"](../codeunit/7802.md) (1 call: `Authenticate → AcquireTokenWithClientCredentials`) - [Codeunit 7807 "Azure Functions OAuth2 Cert"](../codeunit/7807.md) (1 call: `Authenticate → AcquireTokensWithCertificate`) - [Page 4509 "Email - Outlook API Setup"](../page/4509.md) (1 call: `OnOpenPage → GetDefaultRedirectURL`) - [Page 4705 "VAT Group Setup Guide"](../page/4705.md) (1 call: `ShowSetupMemberOAuth2Step → GetDefaultRedirectURL`) - [Page 7200 "CDS Connection Setup"](../page/7200.md) (1 call: `InitializeDefaultRedirectUrl → GetDefaultRedirectURL`) - [Page 9861 "AAD Application Card"](../page/9861.md) (1 call: `GrantConsent → RequestClientCredentialsAdminPermissions`) - [Page extension 4703 "VAT Report Setup Extension"](../pageextension/4703.md) (1 call: `OnOpenPage → GetDefaultRedirectURL`) - [Table 1680 "Email Logging Setup"](../table/1680.md) (1 call: `GetDefaultRedirectUrl → GetDefaultRedirectURL`) ## Across versions - Present in: BC23-30 - Changed (declaration) in: BC24, BC26-28 Source: AL metadata extracted from the code (names, ids, signatures, properties); no code bodies (D10). ## Ask your agent Procedure bodies are not stored here (D10). The call sections above are our own, per object, from the BC29 call graph. For a procedure body or the calls of one procedure, ask bc-code-atlas (external, by Stefan Maron, MIT; default corpus w1-28), which the bc-observatory plugin connects: `bcatlas_resolve_node(object_type: "codeunit", object_name: "OAuth2")`, then `bcatlas_get_procedure_body` or `bcatlas_get_neighbors` on the returned id.