AFAS is moving to OAuth: what changes in your Talend jobs?

AFAS is replacing the Classic tokens of its App Connectors with OAuth 2.0. In September 2026 every existing Classic token gets an end date: 15 February 2027. On 31 August 2027 Classic authentication stops for good. Every integration that currently talks to the Profit REST Services with a Classic token, including your Talend jobs, has to be rebuilt before that date.

It affects every App Connector you maintain yourself, including the Talend jobs that read from or write to AFAS.

Why AFAS is switching

A Classic token is, in practice, valid indefinitely. Whoever holds the token can use it for years against the linked Get- and UpdateConnectors. If such a token leaves the organisation, the leak stays open until someone notices and revokes it. AFAS itself states that Classic tokens are not technically less secure; the problem is how they are used: long-lived, managed by hand, and often copied to several places.

OAuth 2.0 solves that with short-lived access tokens. A token is valid for one hour and is then requested again automatically by the integration software. A leaked token is worthless after an hour at most. In addition, a client id and client secret per integration give you more control over who has access and to which connectors.

What changes

The App Connector remains the place in Profit where you decide which Get- and UpdateConnectors an integration may use. What changes is how the integration identifies itself.

	Classic token	OAuth 2.0
Credential	One token, tied to a user	Client id + client secret per App Connector
Validity	Practically unlimited	Access token: 1 hour
Header sent to the connector	Authorization: AfasToken <base64 of the token XML>	Authorization: Bearer <access_token>
Extra step	None	Obtain a token from the token endpoint first
Renewal	Manual, rarely	Automatic, by the integration

AFAS supports two OAuth flows. The client credentials flow is meant for system-to-system integrations without a logged-in user; that is the flow for ETL and therefore for Talend. The authorization code flow is for applications where an end user logs in to AFAS Online and grants consent. In the client credentials flow AFAS issues no refresh tokens: after an hour you simply request a new access token with the client id and secret.

The token endpoint follows the pattern of your environment:

POST https://<environment-number>.rest.afas.online/profitrestservices/oauth/token

The exact parameters (grant type, client id, client secret) are in the AFAS technical documentation (in Dutch). The response contains an access_token that you send in the Authorization header of every connector call.

Two practical points from the AFAS documentation. The client secret cannot be retrieved after it has been generated, only regenerated (which invalidates the old secret). And from Profit 9 onwards you can change the authentication method of an existing App Connector from Classic token to Hybrid or OAuth without creating a new connector; linked connectors and IP restrictions are preserved. Hybrid accepts both methods at the same time and is therefore the natural transition form.

The timeline

• September 2026: AFAS gives every existing Classic token an end date.
• 15 February 2027: existing Classic tokens stop working. Tokens created after this date work until 31 August 2027 at the latest.
• 31 August 2027: end of Classic authentication. App Connectors still running on a Classic token stop working.

Standard integrations delivered by AFAS itself (Payment Service, Remote Tool and the like) are migrated by AFAS. Action is needed for every App Connector that the customer maintains itself (the Profit label is “Onderhoud door klant”) with Classic or Hybrid authentication. Talend jobs normally fall into that category.

What this means for your Talend jobs

A Talend job that calls AFAS usually does so with a tRESTClient or tHttpRequest to https://<environment-number>.rest.afas.online/profitrestservices/connectors/<connector-name>, with the Classic token as a fixed header, often from a context variable. That pattern needs to change in five places.

1. Take inventory. Find every job, joblet and context group that contains an AfasToken. In practice the same token sits in several jobs, context files and sometimes in Talend Management Console (or TAC). Record per job which Get- and UpdateConnectors it uses; you need that list when configuring the OAuth App Connector.

2. Add a token step. Before the first connector call the job obtains an access token: a tRESTClient (POST) to the token endpoint with client id and client secret, a tExtractJSONFields that pulls the access_token from the response, and a tSetGlobalVar that stores it in the globalMap. Build this as a joblet so every AFAS job reuses the same token step.

3. Change the header. The connector call no longer sends AfasToken <base64> but Bearer <access_token>. In tRESTClient you can set authentication to OAuth2 Bearer and pass the token from the globalMap; in tHttpRequest you set the Authorization header yourself.

4. Account for the one-hour validity. For most batch jobs one token per run is enough. Jobs that run longer than an hour, or that make thousands of calls in a loop, need a check: store the time of issue and request a new token when it is about to expire, or catch an HTTP 401 and retry once with a fresh token.

5. Treat the secrets as secrets. Client id and client secret do not belong in plain text in a context file or in the job itself. Use encrypted context parameters, Talend Management Console (or TAC) or your platform’s secret store. Rotate the secret if you suspect it has leaked; old tokens then expire by themselves within an hour.

Test the rebuilt job against an App Connector set to Hybrid. The existing production integration keeps working on the Classic token while the new version uses OAuth against the same connectors. Once both jobs produce the same results in the test environment, promote the OAuth variant and remove the Classic token from the App Connector.

Step-by-step plan until August 2027

1. Inventory all AFAS integrations and the Talend jobs behind them (September to October 2026).
2. Set the App Connectors in Profit to Hybrid and generate a client id and secret per integration.
3. Build the token step as a joblet and adapt the jobs.
4. Test in Hybrid mode alongside the existing integration; compare the output.
5. Promote to production well before 15 February 2027 and remove the Classic tokens.
6. Set the App Connectors to OAuth-only after the last migration.

Do not wait for the final deadline. The 15 February 2027 date affects every existing token, and the change requires coordination between application management (Profit) and the ETL developers (Talend). Starting in the autumn of 2026 leaves room to test without production pressure.

How cimt can help

cimt has worked with Talend since 2009 (formerly as a Talend Platinum Partner, now as a Qlik Elite Partner), builds and manages Talend environments, and has experience with integrations on AFAS Profit. For the move to OAuth we can:

• inventory the existing AFAS integrations and Talend jobs and assess the impact per job;
• set up the App Connectors in Profit to Hybrid and later OAuth together with your application manager;
• build the token step as a reusable joblet and adapt the jobs, including secret management and error handling;
• test the rebuilt jobs against the Hybrid connector and guide the transition to production.

For clients with a managed services contract we include the migration in regular operations. For others it is a clearly scoped engagement within our data integration practice.

Want to know what the switch means for your Talend jobs? Get in touch and we will review your AFAS integrations together and plan the changes before the first deadline.

Sources

• AFAS customer portal, OAuth theme page (in Dutch): background, timeline and what customers and vendors must do.
• AFAS Help Center, Overstappen van classic tokens op OAuth (in Dutch): migration steps per App Connector, Hybrid, and in-place conversion from Profit 9.
• AFAS Help Center, Eigen app connector inrichten in vogelvlucht (OAuth-token) (in Dutch): client credentials flow, token endpoint and access token validity.
• AFAS, technical documentation on authentication (in Dutch): parameters of the token request.
• Qlik Talend Help, tRESTClient: authentication options, including OAuth2 Bearer.