API Security with OIDC/OAuth 2.0

Coupa uses OpenID Connect (OIDC), an open authentication protocol that extends OAuth 2.0 for an improved level of security for API integrations with Coupa.

Client Purpose

The OAuth/OIDC Client Configuration page includes a mandatory Client Purpose dropdown field. This field identifies how your integration uses the client — for example, as a customer/internal admin tool, a third-party software provider, or a marketplace application partner.

• A Client Purpose dropdown appears on the OAuth/OIDC Client Configuration page. Options include:
  • Customer/Internal Admin
  • Third-Party Software Provider
  • App Marketplace Application Partner
• If you select Third-Party Software Provider, you must also enter the provider name.
• An acknowledgment checkbox requires you to confirm that the information you provided is accurate and complete before you can save.
• All fields are mandatory. You cannot save the client configuration without completing them.

Configure Client Purpose for new clients

When you create a new OAuth/OIDC client, the system prompts you to:

1. Select a Client Purpose from the dropdown.
2. Enter the third-party provider name (if applicable).
3. Check the acknowledgment box at the bottom of the page.
4. Select Save.

Update Client Purpose for existing clients

If you have existing OAuth/OIDC clients that do not have a Client Purpose specified:

1. Navigate to the OAuth/OIDC Client Configuration page.
2. Select Edit (pencil icon) on the client you want to update.
3. Complete the Client Purpose field and acknowledgment checkbox.
4. Select Save.

You must update all existing clients. A banner on the configuration page reminds you: "Please update newly required OAuth/OIDC settings."

IP whitelisting

You can restrict API access to specific IP addresses by configuring an IP allowlist on your OAuth/OIDC clients. When IP whitelisting is enabled, Coupa rejects any API request that originates from an IP address not included in the allowlist.

To configure IP whitelisting:

1. Navigate to the OAuth/OIDC Client Configuration page.
2. Select Edit on the client you want to restrict.
3. In the IP Whitelisting field, enter the allowed IP addresses or CIDR ranges.
4. Select Save.

Requests from IP addresses outside the allowlist receive a 403 Forbidden response.

Data access restrictions

You can restrict OAuth/OIDC clients with the client credentials grant type to access only specific subsets of data. This prevents a single client from accessing all transactional and master data across your instance.

• Account groups (transactional data): Assign one or more account groups to a client. The client can only access transactional data (such as invoices, purchase orders, requisitions, and expense reports) that belongs to those account groups.
• Business groups (master data): Assign one or more business groups to a client. The client can only access master data (such as suppliers, contracts, addresses, and payment terms) tagged with those business groups.

To configure data access restrictions:

1. Navigate to the OAuth/OIDC Client Configuration page.
2. Select Edit on the client credentials client you want to restrict.
3. In the Account Groups field, select the account groups for transactional data access.
4. In the Business Groups field, select the business groups for master data access.
5. Select Save.

API telemetry and usage tracking

Coupa captures comprehensive API telemetry data that links API requests to individual customers, partner apps, and AI agents. This data enables internal reporting on API usage patterns, request volumes, and integration activity across your instance.

Telemetry data is collected automatically for all API requests made through OAuth/OIDC clients. No additional configuration is required.