SAP S/4HANA and Tipalti integration

What moves between them

The main flow is SAP S/4HANA into Tipalti. Supplier invoices created in SAP are pushed into Tipalti for approval and payment processing on a daily or weekly schedule. Supplier master records and GL accounts are synced so that payment allocations in Tipalti land on valid SAP cost centers and GL accounts. Payment confirmations from Tipalti flow back into SAP via the webhook callback, recording the payment date, reference number, and amount so that bank reconciliation and accruals do not go stale. GL accounts and cost centers remain read-only in SAP and are pulled only for reference and validation.

How ml-connector handles it

ml-connector stores both credential sets encrypted and handles the full OAuth 2.0 token refresh cycle on the SAP side, caching tokens before expiry and refreshing when a call fails with 401. On the Tipalti side, it handles HMAC-SHA256 signature generation for SOAP calls, using the payer name and API key from the encrypted credential store. Because SAP has no native webhooks, it polls the supplier invoice and purchase order OData endpoints on a configurable schedule tied to your payment cycle, using delta tokens for efficiency on subsequent runs. Supplier names, GL account numbers, and cost center codes are mapped by ml-connector before the first invoice is sent, ensuring that payment accounting is correct. When Tipalti confirms a payment via IPN webhook, ml-connector validates the HMAC-SHA256 signature, looks up the original SAP invoice by reference, and records the payment reference and date in SAP so the ledger stays current. If a webhook fails, ml-connector retries the write to SAP, and every record carries a full audit trail.

A real-world example

A mid-sized manufacturing company runs SAP S/4HANA for procurement and finance across multiple plants in North America and Europe. They use Tipalti for supplier invoice approval and multi-currency payments to reduce manual approval steps and payment delays. Before the integration, the accounts payable team exported invoice reports from SAP, re-entered them into Tipalti by hand, then manually recorded payment confirmations back into SAP journal entries, with constant risk of duplicates and missed invoices. With SAP S/4HANA and Tipalti connected, invoices flow automatically into Tipalti for approval, payments are processed on time, and payment confirmations sync back into SAP within 24 hours. The monthly bank reconciliation now completes in days instead of weeks because the cash account is up to date.

What you can do

• •Sync supplier invoices from SAP S/4HANA to Tipalti on a daily or weekly schedule, with GL account and cost center validation before submission.
• •Keep supplier master records aligned between SAP and Tipalti so new suppliers and compliance status are consistent across both systems.
• •Record payment confirmations from Tipalti back into SAP invoice records, capturing payment date, reference, and amount for timely cash accounting.
• •Authenticate SAP with OAuth 2.0 and Tipalti with HMAC-SHA256 SOAP signatures, managing token refresh and credential storage across both APIs.
• •Poll SAP invoices and suppliers using OData delta tokens for efficiency, and validate incoming Tipalti webhook signatures before recording payment events.

Questions

Which direction does data move between SAP S/4HANA and Tipalti?

The main flow is SAP into Tipalti. Supplier invoices and supplier master records move from SAP into Tipalti for processing and payment. Payment confirmations flow back into SAP via webhook so that invoices are marked as paid and cash position is current. GL accounts and cost centers are read from SAP for validation but not written back.

How does the integration handle SAP's OAuth token lifecycle and Tipalti's HMAC-SHA256 signatures?

ml-connector caches SAP OAuth 2.0 tokens after obtaining them and refreshes them before expiry, using the token endpoint from your Communication Arrangement. On the Tipalti side, it generates HMAC-SHA256 signatures on each SOAP call by hashing the payer name and API key together, and validates incoming webhook signatures the same way to prevent replay attacks.

How does polling work if SAP has no webhooks?

ml-connector polls the SAP OData endpoints for supplier invoices and purchase orders on a configurable schedule, using delta tokens for subsequent syncs so only changed records are fetched. This reduces API calls and latency. Once a Tipalti payment is confirmed, the webhook callback triggers ml-connector to write the payment reference back into SAP immediately rather than waiting for the next poll cycle.