Error 403 due to CSRF token or session timeout when integrating SAP with a mobile app is a typical problem even experienced teams face. Nearly every second project comes to us after a failed attempt to 'do it ourselves.' SAP mobile app integration, whether using SAP OData mobile, SAP BAPI mobile, or other protocols, requires understanding the SAP landscape: different versions (ECC 6.0, S/4HANA on-premise or Cloud), protocols (OData v2, v4, BAPI), and security requirements (OAuth 2.0, SAML). Over 10 years of experience and 30+ successful projects, we have developed an approach that is 3 times faster than building your own middleware. The key lesson: do not start coding without an API audit and proper middleware selection — a mistake that costs weeks of rework. A typical audit costs $2,000 and takes 3-5 days.
SAP Mobile Services is not just middleware but a full platform that accelerates integration by 3x thanks to built-in caching, authentication, and offline synchronization mechanisms. Unlike custom Spring Boot solutions, it eliminates manual CSRF token handling, session management, and conflict resolution. But proper configuration is essential: a common mistake is ignoring synchronization policies, which leads to data loss on connection drops. For push notifications, we use Firebase Cloud Messaging (FCM) on Android and Apple Push Notification Service (APNs) on iOS, integrated with SAP Mobile Services.
Three Generations of SAP API: Comparison
| Generation | Protocol | When to Use |
|---|---|---|
| BAPI / RFC | ABAP, via JCo/NCo | Legacy SAP ECC, if no Gateway |
| SAP Gateway / OData v2 | REST, Atom XML/JSON | ECC 6.0, NetWeaver, S/4HANA on-premise |
| SAP BTP + CAP (OData v4) | REST, JSON | S/4HANA Cloud, new projects |
How to Set Up CSRF Handling in a Mobile App?
The standard workflow with CSRF token in SAP OData consists of four steps. First, perform a GET request to the service endpoint with the header X-CSRF-Token: Fetch. SAP returns the token in the response header X-CSRF-Token. For all modifying requests (POST, PUT, DELETE, PATCH), include the obtained token in the header X-CSRF-Token. Upon receiving a 403 CSRF token validation failed, repeat steps 1-3. We implement this algorithm in an Interceptor on Retrofit or Alamofire, automatically refreshing the token on error. The token is valid within a session, so after re-authentication, a new token must be fetched. This eliminates 90% of authorization errors.
Example using the SDK on Android:
val serviceManager = ServiceManager( applicationContext, SAPServiceManager.configUrl, object : ServiceManager.ServiceManagerListener { override fun onServiceManagerReady() { // Ready to work initializeODataService() } } ) How to Implement Offline Synchronization with SAP?
Using the OData Offline Store from SAP BTP SDK reduces mobile data usage by 60-70% compared to a constant connection. According to official documentation of SAP BTP SDK, offline synchronization requires configuring conflict policies. Data is cached locally in SQLite, and when the network is available, bidirectional synchronization is performed. Conflicts are resolved via ETag — the server checks whether the data has changed since the last read. However, offline mode increases integration complexity: synchronization policies must be properly configured. We choose a first writer or server version strategy depending on the business logic.
Authentication Methods: SAML vs OAuth
| Method | Protocol | When to Use |
|---|---|---|
| SAML 2.0 | XML-based, browser | SAP ECC on NetWeaver |
| OAuth 2.0 | JWT, via Authorization Code | S/4HANA Cloud, SAP BTP |
| Basic Auth | HTTP Basic | Only for testing |
We recommend adding an OAuth 2.0 proxy via SAP BTP or Keycloak: the mobile app uses standard OAuth, while SAP receives SAML requests. This reduces integration fragility.
Common Pitfalls and Solutions
- OData v2 performance.
$expandfor navigation properties executes JOINs on the SAP ABAP side — may take 5-15 seconds. Alternative: parallel requests without expand or middleware caching. - Pagination in OData v2.
$skip+$topis slow on large volumes — server-side pagination via SAP skiptoken is preferred. - Differences between S/4HANA and ECC. APIs for the same object (e.g., sales order) in S/4HANA OData (
API_SALES_ORDER_SRV) and ECC Gateway (ZSHOP_SRV) differ. An abstraction layer in middleware is mandatory for supporting both.
Choosing an API for Integration
If the client has S/4HANA Cloud, OData v4 via CAP is the clear choice. If ECC or S/4HANA on-premise, check for SAP Gateway. Gateway provides SAP ECC OData v2 but with quirks: Edm.DateTime instead of ISO 8601, specific filtering, __deferred for navigation properties. For ECC without Gateway, BAPI via middleware (SAP JCo or NCo) remains. An abstraction layer in middleware is mandatory if support for both variants is needed. For a robust SAP mobile application, offline sync is essential. Enterprise resource planning (ERP) mobile integration, specifically SAP, is complex.
What's Included in the Work
- API and integration architecture documentation
- Access to SAP BTP or middleware (if needed)
- Training the customer's team on solution operation
- 3 months of warranty support after deployment
Process of Work
- Audit of SAP landscape and available APIs — 3-5 days. Determine SAP version, check OData Gateway or BAPI availability, test performance.
- Integration architecture design — 1-2 weeks. Select stack (BTP SDK, offline strategy, authentication method).
- Prototype implementation — 1-2 weeks. Data reading, authentication setup, basic synchronization.
- Full integration — 2-4 months. Add offline support, CSRF handling, conflict resolution, push notifications.
- Documentation and team training — 1-2 weeks. Hand over API, configuration, and operation documentation.
- Warranty support — 3 months after deployment. Fix errors, assist with modifications.
Cost is calculated individually after the audit. Order a prototype in 2 weeks — we'll show a working solution on your data. Contact us for an audit of your SAP landscape and get a detailed integration plan. We guarantee up to 50% reduction in integration costs compared to self-made solutions.