How to Integrate Bolt.new with Microsoft Dynamics 365

Dynamics 365 uses Azure Active Directory (Microsoft Entra ID) for authentication — there is no standalone developer portal or API key. You register an application in the Azure Portal, grant it permission to access Dynamics 365, and use OAuth 2.0 to obtain access tokens. Go to portal.azure.com and sign in with your organizational Microsoft account. Navigate to 'Azure Active Directory' (or search for 'Microsoft Entra ID' — they are the same service). Click 'App registrations' → 'New registration.' Give your app a name (e.g., 'My Bolt App'). For the Redirect URI, select 'Web' and enter your deployed site URL: https://your-app.netlify.app/api/auth/callback/dynamics. This cannot be the Bolt WebContainer preview URL — register the deployed Netlify or Bolt Cloud URL. After creating the app, go to 'Certificates & secrets' → 'New client secret.' Give it a description and choose an expiration period. Copy the Value immediately — it is only shown once. Store it as AZURE_CLIENT_SECRET in .env. Next, configure API permissions. Click 'API permissions' → 'Add a permission' → 'Dynamics CRM' → 'Delegated permissions.' Check 'user_impersonation' (allows the app to access Dynamics 365 on behalf of the signed-in user). For service-to-service access (no user interaction), use 'Application permissions' instead of 'Delegated.' Click 'Grant admin consent' to authorize the permissions for your Azure AD tenant — this requires an Azure AD Global Administrator. Note your Application (client) ID and Directory (tenant) ID from the app's Overview page. Store them as AZURE_CLIENT_ID and AZURE_TENANT_ID in .env. Your Dynamics 365 organization URL (e.g., https://yourorg.crm.dynamics.com) goes in as DYNAMICS_ORG_URL. The OAuth authorization URL format is: https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize. The token endpoint is: https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token. The Dynamics 365 API scope is your org URL followed by /.default: https://yourorg.crm.dynamics.com/.default.

1# .env
2# Azure AD app registration credentials
3# Get from portal.azure.com → Azure Active Directory → App registrations → your app
4AZURE_CLIENT_ID=your-app-client-id-here
5AZURE_TENANT_ID=your-azure-ad-tenant-id-here
6AZURE_CLIENT_SECRET=your-client-secret-value-here
7
8# Dynamics 365 organization URL
9# Find in Dynamics Settings → Customizations → Developer Resources
10DYNAMICS_ORG_URL=https://yourorg.crm.dynamics.com
11
12# Access token (populated after completing OAuth flow)
13# Server-side only — never NEXT_PUBLIC_
14DYNAMICS_ACCESS_TOKEN=your_access_token_here
15
16# Your deployed app URL for OAuth redirect URI
17NEXT_PUBLIC_APP_URL=https://your-app.netlify.app

Build the OAuth callback handler and the Dynamics 365 API service. Azure AD OAuth 2.0 follows the standard authorization code flow but uses Microsoft's identity endpoints rather than generic OAuth. The authorization URL structure: https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize?client_id={client_id}&response_type=code&redirect_uri={redirect_uri}&scope={scope}&response_mode=query. The scope for Dynamics 365 is your org URL with /.default appended: https://yourorg.crm.dynamics.com/.default. This tells Azure AD to grant all the Dynamics 365 permissions you configured in the app registration. The token endpoint is https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token. The token response includes access_token (Bearer token for API calls), expires_in (seconds until expiry, typically 3600 = 1 hour), and refresh_token (for obtaining new tokens without re-authorization). For service-to-service access without user interaction (when your Bolt app accesses Dynamics on behalf of the application itself, not a specific user), use the client credentials flow: POST to the token endpoint with grant_type=client_credentials, client_id, client_secret, and scope. This is simpler and more appropriate for background integrations — you do not need a redirect URI or user authorization. Note that client credentials require Application permissions in Azure AD, not Delegated permissions. For the Dynamics 365 Web API service, every request needs the access token in the Authorization header and an OData-Version: 4.0 header. Include Accept: application/json for JSON responses. The Prefer: odata.include-annotations='*' header enables rich metadata in responses including option set labels.

1// lib/dynamics.ts
2const getDynamicsBase = () => {
3  const orgUrl = process.env.DYNAMICS_ORG_URL;
4  if (!orgUrl) throw new Error('DYNAMICS_ORG_URL not configured');
5  return `${orgUrl}/api/data/v9.2`;
6};
7
8async function dynamicsFetch<T>(
9  path: string,
10  options: RequestInit = {}
11): Promise<T> {
12  const token = process.env.DYNAMICS_ACCESS_TOKEN;
13  if (!token) throw new Error('DYNAMICS_ACCESS_TOKEN not configured');
14
15  const res = await fetch(`${getDynamicsBase()}${path}`, {
16    ...options,
17    headers: {
18      Authorization: `Bearer ${token}`,
19      'OData-Version': '4.0',
20      'OData-MaxVersion': '4.0',
21      Accept: 'application/json',
22      'Content-Type': 'application/json',
23      ...options.headers,
24    },
25  });
26
27  if (!res.ok) {
28    const body = await res.json().catch(() => ({ error: { message: res.statusText } }));
29    throw Object.assign(new Error(body.error?.message ?? 'Dynamics API error'), {
30      status: res.status,
31    });
32  }
33
34  // DELETE returns 204 No Content
35  if (res.status === 204) return {} as T;
36  return res.json();
37}
38
39export async function getOpportunities(
40  filter?: string,
41  select = 'name,estimatedvalue,salesstage,estimatedclosedate,statecode'
42) {
43  const params = new URLSearchParams({ '$select': select });
44  if (filter) params.set('$filter', filter);
45  params.set('$orderby', 'estimatedvalue desc');
46  return dynamicsFetch<{ value: Record<string, unknown>[] }>(
47    `/opportunities?${params}`
48  );
49}
50
51export async function getContacts(
52  filter?: string,
53  select = 'fullname,emailaddress1,telephone1,parentcustomerid'
54) {
55  const params = new URLSearchParams({ '$select': select });
56  if (filter) params.set('$filter', filter);
57  return dynamicsFetch<{ value: Record<string, unknown>[] }>(`/contacts?${params}`);
58}
59
60export async function createRecord(
61  entitySetName: string,
62  data: Record<string, unknown>
63) {
64  return dynamicsFetch<Record<string, unknown>>(`/${entitySetName}`, {
65    method: 'POST',
66    body: JSON.stringify(data),
67  });
68}
69
70export async function updateRecord(
71  entitySetName: string,
72  id: string,
73  data: Record<string, unknown>
74) {
75  return dynamicsFetch<void>(`/${entitySetName}(${id})`, {
76    method: 'PATCH',
77    body: JSON.stringify(data),
78  });
79}

Build the OAuth callback handler that completes the Azure AD authorization flow on your deployed site. The callback receives the authorization code from Azure AD after user consent and exchanges it for access and refresh tokens. Azure AD OAuth returns the code in a query parameter and also includes a state parameter you can use to prevent CSRF attacks. The token exchange POSTs to https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token with grant_type=authorization_code, code, redirect_uri (must match registration exactly), client_id, client_secret, and scope. Azure AD access tokens expire after one hour (3600 seconds). The refresh token has a longer lifetime (typically 90 days for interactive flows). Implement automatic token refresh by catching 401 responses in dynamicsFetch and refreshing before retrying. For serverless deployments on Netlify, store tokens in Supabase rather than process.env — serverless function instances do not share memory, so process.env assignments do not persist across invocations. For service-to-service integrations where no user interaction is needed (the most common pattern for Bolt.new dashboards reading company CRM data), the client credentials flow is simpler. POST to the token endpoint with grant_type=client_credentials and client_id/client_secret — you get a token immediately without any redirect or user authorization. This requires Application permissions in Azure AD (not Delegated) and is supported for Dynamics 365. The client credentials approach is ideal for dashboards and reporting tools that do not need to impersonate specific users.

1// app/api/auth/callback/dynamics/route.ts
2import { NextResponse } from 'next/server';
3
4export async function GET(request: Request) {
5  const { searchParams } = new URL(request.url);
6  const code = searchParams.get('code');
7  if (!code) {
8    return NextResponse.json({ error: 'Missing authorization code' }, { status: 400 });
9  }
10
11  const tenantId = process.env.AZURE_TENANT_ID!;
12  const appUrl = process.env.NEXT_PUBLIC_APP_URL!;
13
14  const tokenRes = await fetch(
15    `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
16    {
17      method: 'POST',
18      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
19      body: new URLSearchParams({
20        grant_type: 'authorization_code',
21        code,
22        redirect_uri: `${appUrl}/api/auth/callback/dynamics`,
23        client_id: process.env.AZURE_CLIENT_ID!,
24        client_secret: process.env.AZURE_CLIENT_SECRET!,
25        scope: `${process.env.DYNAMICS_ORG_URL}/.default`,
26      }),
27    }
28  );
29
30  if (!tokenRes.ok) {
31    const err = await tokenRes.json();
32    return NextResponse.json({ error: err }, { status: 400 });
33  }
34
35  const tokens = await tokenRes.json();
36  console.log('Dynamics tokens:', {
37    access_token_preview: tokens.access_token?.substring(0, 30) + '...',
38    expires_in: tokens.expires_in,
39    has_refresh_token: !!tokens.refresh_token,
40  });
41
42  // Store access_token as DYNAMICS_ACCESS_TOKEN in hosting env vars
43  return NextResponse.redirect(new URL('/dashboard', request.url));
44}

Build the opportunity pipeline dashboard using Dynamics 365's OData query capabilities. OData enables server-side filtering, sorting, and field selection that reduces data transfer and API processing time compared to fetching all records and filtering client-side. The Dynamics 365 Web API supports standard OData v4 query options: $select (specify which fields to return — always use this to avoid fetching all entity fields), $filter (server-side filtering using OData expressions), $orderby (sort results), $top (limit result count), $expand (include related entity data in one request), and $count (include a total record count). Key OData filter expressions for Dynamics: statecode eq 0 (open/active records), estimatedclosedate gt 2024-01-01T00:00:00Z (date comparisons use ISO format), contains(name, 'Acme') (string contains), and _ownerid_value eq {guid} (filter by owner using lookup field). For the pipeline dashboard, fetch opportunities with statecode eq 0 (open) and $select=name,estimatedvalue,salesstage,estimatedclosedate,_ownerid_value&$expand=ownerid($select=fullname). The $expand fetches the related owner's full name in a single request rather than requiring separate lookup calls. Dynamics 365 returns lookup field values (foreign keys) with a special naming convention: the field name is prefixed with underscore and suffixed with _value. For example, the opportunity owner lookup is _ownerid_value (returns a GUID), while $expand=ownerid($select=fullname) returns the actual name. Always use $expand for related record display to avoid N+1 query patterns.

1// app/api/dynamics/opportunities/route.ts
2import { NextResponse } from 'next/server';
3import { getOpportunities } from '@/lib/dynamics';
4
5export async function GET(request: Request) {
6  const { searchParams } = new URL(request.url);
7  const filter = searchParams.get('filter') ?? 'statecode eq 0';
8
9  try {
10    const data = await getOpportunities(
11      filter,
12      'name,estimatedvalue,salesstage,estimatedclosedate,statecode,_ownerid_value'
13    );
14
15    const opportunities = (data.value ?? []).map((opp) => ({
16      id: opp.opportunityid,
17      name: opp.name,
18      value: typeof opp.estimatedvalue === 'number' ? opp.estimatedvalue : 0,
19      stage: opp.salesstage ?? 'Unknown',
20      closeDate: opp.estimatedclosedate,
21      ownerId: opp._ownerid_value,
22    }));
23
24    return NextResponse.json({
25      opportunities,
26      totalValue: opportunities.reduce((sum, o) => sum + o.value, 0),
27    });
28  } catch (error) {
29    const message = error instanceof Error ? error.message : 'Unknown error';
30    return NextResponse.json({ error: message }, { status: 500 });
31  }
32}