by Steve Endow
[This blog post was 100% human written. None of this post was drafted or written by an AI.]
We received an email from a partner asking me to help someone with a BC Web API authentication issue.
"We are getting an authentication error with our API web access key when trying to connect to the customer's BC environment."
Say what? This is in July 2026. Business Central hasn't had web access keys since 2022. Red flag #1.
I was busy, so I assumed someone else helped resolve the issue.
The next day, we get another email from the partner. We learn that it is a third party ecommerce provider who is having the issue. The partner provides a link to a video.
I hover over the link in the email. It points to a Google Drive. I click on it and a video opens in my browser. Without any authentication. Just keep this in mind for few moments...
The video shows the authentication screen in the Postman application. There is no audio. The person is apparently trying to configure an OAuth connection to the Business Central Web API.
The Postman URL shows "ODataV4". In July 2026. Red flag #2.
The video shows a mouse highlighting the elements of the URL, the auth endpoints, the client ID, etc. The video then switches to Notepad++, showing the OAuth connection information.
Client ID
Secret Value
The file path in Notepad++ shows that this information is saved in a TXT file in the user's local Documents folder. Red flag #3.
