Introduction
AFAS is switching from the current Classic tokens to OAuth. If your organisation uses an AFAS integration with BCS Connect, this will affect the way that integration logs in to AFAS.
This article explains what is changing, what the schedule is, what we ask of you and how the switch will take place.
AFAS is phasing out Classic tokens. We will contact you when your environment needs to be updated. Only share your OAuth details via a secure channel.
What is changing?
For you, the main change is the way the integration logs in to AFAS. The data exchanged and the configuration of your integration will in principle remain the same. You therefore do not need to configure any new GetConnectors or field mappings.
- The existing Classic token will be replaced by an OAuth client ID and client secret.
- BCS Connect will use these details automatically to connect to AFAS.
- Your AFAS user and their permissions will continue to determine which data can be retrieved.
- From Profit 9 onwards, a client secret has a limited validity period, 180 days by default. You will therefore need to renew it from time to time.
We will coordinate the switch with you and let you know when your environment is due to be migrated.
General schedule
| Period | What happens? |
|---|---|
| From September 2026 | Existing Classic tokens will be given an expiry date. |
| As soon as the required platform update is available | We will first test the OAuth integration in test and acceptance environments. |
| By 1 March 2027 at the latest | We recommend switching production environments. This leaves enough time for checks and recovery. |
| 1 May 2027 | Existing Classic tokens will expire. An integration that still uses only a Classic token may stop working. |
| 31 August 2027 | Classic tokens will no longer work. |
What do we ask of you?
- Check which AFAS environment(s) you use: production, test and/or acceptance.
- Check which version of Profit you use.
- Agree who within your organisation manages the AFAS app connector.
- Create OAuth details, or convert the existing app connector, when we instruct you to do so.
- Only share the client ID and client secret via the agreed secure channel.
- For each environment, provide us with the environment number and the expiry date of the client secret.
- Set a reminder to renew the client secret on time.
Never send the client secret via ordinary email, chat or a reply in a ticket. Treat it as a password and only use the secure channel agreed with you.
How will the switch take place?
- We will let you know when your environment can be migrated.
- You will provide the OAuth details securely.
- We will adjust the login method of the existing integration. The data mapping and schedule will remain the same.
- We will test the connection and check that the correct data is being received.
- Was the test successful? You will then disable the old Classic token, or permanently switch the app connector to OAuth.
- Together, we will check the next scheduled synchronisation.
Only disable the old Classic token after we have confirmed that the new integration is working. Otherwise, synchronisation will stop.
After the switch: renewing the client secret
From Profit 9 onwards, a client secret expires after 180 days by default, unless a different period has been configured in AFAS. Therefore, start the renewal process at least two to three weeks before the expiry date.
By switching and renewing on time, you can prevent the synchronisation of new employees, changes and leavers from stopping.
Frequently asked questions
Do I need to create new GetConnectors?
In most cases, no. The existing GetConnectors and field mappings will remain the same.
Does an employee need to log in or give permission?
No. The integration works automatically with the AFAS user linked to the app connector.
What happens if the client secret expires?
Synchronisation may stop. You will then provide a new secret via the secure channel, and we will process it in the integration.
Can production, test and acceptance use the same OAuth details?
No, each AFAS environment has its own details. Always use the client ID and client secret belonging to that environment.
Do you have another question? Send an email to support.plek@bcs-hr.com.