Every SAP product proves who you are a different way. S/4HANA wants a communication user. BTP wants an XSUAA OAuth2 client. Datasphere wants a service key. AI Core wants a bearer token minted from a different grant. None of them speak the same dialect, and none of them store credentials the way a CLI should.
sapctl collapses that into one verb: sapctl auth login. One command, one credential store, one mental model, no matter which SAP product you are about to touch.
The problem
Before sapctl, wiring a script to two SAP products meant two auth flows, two token refreshes, and two places to leak a secret. A SOX journal extract touches S/4HANA; a BTP subaccount audit touches XSUAA; a Datasphere snapshot touches a service key. Three auth systems for one audit.
Each flow fails in its own way. XSUAA tokens expire and need a client-credentials grant. Basic auth against S/4 needs a communication user with the right role collection. Service keys are long-lived and easy to paste into the wrong file.
The design
sapctl models every SAP auth system as a provider behind a single interface:
sapctl auth login --flow xsuaa --label trial \
--client-id $CID --client-secret $CSECRET --token-url $TURL
sapctl auth login --flow apikey --label sandbox --api-key "$KEY"
sapctl auth login --flow basic --label prod --username "$U" --password "$P"Each credential is stored under a label (trial, sandbox, prod) and referenced by that label on every command. The credential store lives in the OS keychain, not in a dotfile with world-readable permissions.
Why the keychain
Secrets in ~/.config/sapctl/credentials.json with 0600 permissions are better than nothing, but they are still plaintext on disk. The OS keychain gives us encryption at rest, access control, and a place auditors expect secrets to live. sapctl never writes a token to a log, a trace, or a shell history.
What this buys you
One auth model is not a convenience. It is a security boundary. When every product shares one credential store and one verify path, there is one place to audit, one place to rotate, and one place to get it wrong. That is the property a regulated SAP shop actually needs.