Microsoft Dynamics 365

Open the Azure portal at portal.azure.com and sign in with your Microsoft 365 admin account. In the left navigation, click 'Azure Active Directory' (now called Microsoft Entra ID). Select 'App registrations' → '+ New registration'. Give the app a name like 'FlutterFlow Dynamics Connector', leave the Redirect URI blank for now (you're using client credentials, not a user-interactive flow), and click 'Register'. Once created, copy the Application (client) ID and the Directory (tenant) ID — you'll need both for the Cloud Function. Next, click 'API permissions' → '+ Add a permission' → 'Dynamics CRM' → 'Application permissions' → tick 'user_impersonation' (or for true app-only access, add the Dataverse application permission). Click 'Add permissions', then click 'Grant admin consent for [Your Org]' and confirm. Without admin consent, the client-credentials flow will fail. Finally, click 'Certificates & secrets' → '+ New client secret', give it a description like 'FlutterFlow Proxy', set an expiry (24 months recommended), and click 'Add'. Copy the secret VALUE immediately — Azure only shows it once. You now have three values: Tenant ID, Client ID, Client Secret. Store them securely; they go into the Firebase Cloud Function environment, not into FlutterFlow.

The Firebase Cloud Function is the only place your Azure client secret will live. When FlutterFlow calls this function, it returns a short-lived Dynamics 365 access token. Your FlutterFlow app never sees the client secret. In the Firebase Console, open your project, go to 'Build → Functions', and click 'Get started' if you haven't already (Blaze plan required). You'll write the function using the Firebase Console inline editor or your local Firebase CLI environment. Create a file called `index.js` inside your functions folder with the code below. The function receives an HTTPS GET request (from FlutterFlow), calls Microsoft's token endpoint with your stored credentials, and returns the access token as JSON. Store your Azure credentials as Firebase environment variables — in the Firebase CLI, set them with `firebase functions:config:set azure.tenant_id="..." azure.client_id="..." azure.client_secret="..." azure.org_url="https://yourorg.crm.dynamics.com"`. After deploying (`firebase deploy --only functions`), copy the Function's HTTPS trigger URL — that's what FlutterFlow will call.

1const functions = require('firebase-functions');
2const axios = require('axios');
3
4exports.getDynamicsToken = functions.https.onRequest(async (req, res) => {
5  // CORS for FlutterFlow web builds
6  res.set('Access-Control-Allow-Origin', '*');
7  if (req.method === 'OPTIONS') {
8    res.set('Access-Control-Allow-Methods', 'GET');
9    res.set('Access-Control-Allow-Headers', 'Content-Type');
10    return res.status(204).send('');
11  }
12
13  const config = functions.config().azure;
14  const tokenUrl = `https://login.microsoftonline.com/${config.tenant_id}/oauth2/v2.0/token`;
15
16  try {
17    const params = new URLSearchParams();
18    params.append('client_id', config.client_id);
19    params.append('client_secret', config.client_secret);
20    params.append('scope', `${config.org_url}/.default`);
21    params.append('grant_type', 'client_credentials');
22
23    const response = await axios.post(tokenUrl, params);
24    return res.json({
25      access_token: response.data.access_token,
26      expires_in: response.data.expires_in
27    });
28  } catch (err) {
29    console.error('Token error:', err.response?.data || err.message);
30    return res.status(500).json({ error: 'Failed to obtain token' });
31  }
32});
33

Open your FlutterFlow project. In the left navigation panel, click 'API Calls'. At the top right of the API Calls panel, click '+ Add' → 'Create API Group'. Name the group 'Dynamics365' and set the Base URL to your Dynamics org's Dataverse endpoint: `https://yourorg.crm.dynamics.com/api/data/v9.2`. Under 'Headers', add three shared headers that every Dataverse call needs: - `Authorization`: leave the value as a variable for now — you'll pass the token here - `Accept`: `application/json` - `OData-MaxVersion`: `4.0` To make the bearer token injectable, click 'Variables' in the API Group header section, add a variable named `bearerToken` of type String. Then update the Authorization header value to `Bearer [bearerToken]` using FlutterFlow's double-bracket variable syntax. Now add individual API Calls inside this group: 1. Click '+ Add API Call' → name it `getAccounts`, Method GET, Endpoint Path `/accounts?$select=name,accountid,telephone1&$top=50`. 2. Add another → `createLead`, Method POST, Endpoint Path `/leads`. In the Body tab, set Content-Type `application/json` and add a JSON body template with variables for `firstname`, `lastname`, `emailaddress1`, `companyname`. 3. Add `getLeads`, Method GET, Endpoint `/leads?$select=fullname,emailaddress1,leadid&$orderby=createdon desc&$top=25`. Click the 'Response & Test' tab on `getAccounts`. Paste a sample Dynamics response (with the `value` array) and click 'Generate JSON Paths'. FlutterFlow will auto-detect paths like `$.value[0].name` and `$.value[0].accountid`.

1{
2  "method": "GET",
3  "endpoint": "/accounts?$select=name,accountid,telephone1,emailaddress1&$top=50",
4  "headers": {
5    "Authorization": "Bearer [bearerToken]",
6    "Accept": "application/json",
7    "OData-MaxVersion": "4.0"
8  }
9}
10

Because the bearer token expires every hour, your FlutterFlow app needs to fetch a fresh token from your Firebase Cloud Function when it starts, and optionally refresh it before expiry. First, add a separate API Call for the token endpoint. In the API Calls panel, click '+ Add' → 'Create API Group' → name it 'TokenService'. Set the Base URL to your Firebase Cloud Function's HTTPS trigger URL (e.g. `https://us-central1-your-project.cloudfunctions.net/getDynamicsToken`). Add a single API Call named `getToken` with Method GET and no additional parameters. Next, set up App State. Go to 'App Values' in the left nav (the puzzle-piece icon) → 'App State'. Add a String variable named `dynamicsToken` (initial value empty). This variable will hold the current bearer token. Now wire the token fetch to app launch. Click on your initial page (e.g. HomePage) in the left nav. Open the Actions panel. Add an Action on the 'On Page Load' trigger. Choose 'Backend/API Call' → select the `getToken` API Call from TokenService group. In the 'Action Output Variable' section, map the response JSON Path `$.access_token` to the App State variable `dynamicsToken`. Finally, go back to your Dynamics365 API Group. In the group-level 'Variables' section, the `bearerToken` variable should be set to 'App State → dynamicsToken' when you make any API call. In the Action Flow Editor for any widget that calls a Dynamics endpoint, pass `App State → dynamicsToken` as the `bearerToken` argument to the API Call.

Now wire the Dynamics data to your UI. On your main page, drag a 'ListView' widget from the widget panel onto the canvas. Select the ListView and open its 'Backend Query' panel. Set the 'Query Type' to 'API Call', choose the `getAccounts` call from the Dynamics365 group. Under 'Variables', pass `App State → dynamicsToken` as the `bearerToken`. Under 'Response JSON Path', select `$.value` so the ListView iterates over the accounts array. Inside the ListView, add child widgets: a Text widget bound to `$.name` for the account name and a second Text for `$.telephone1`. Run the app in FlutterFlow Run mode — you should see your Dynamics Accounts populate the list. For the create-lead form, add a new page called 'CreateLeadPage'. Drag a Column widget onto the canvas and add TextField widgets for First Name, Last Name, Email, and Company Name. Add a Button widget labeled 'Submit'. In the Button's Actions panel, add a 'Backend/API Call' action pointing to the `createLead` API Call. Map each TextField's text value to the corresponding API Call variable: `firstname`, `lastname`, `emailaddress1`, `companyname`. Pass `App State → dynamicsToken` as `bearerToken`. In the Action Flow Editor, after the API Call succeeds, add a 'Show Snack Bar' action with the message 'Lead created in Dynamics 365!' and a 'Navigate Back' action to return to the main page. For error handling, add a Conditional Action — if the API response status code is not 200–204, show an Alert Dialog with the error message. The Dataverse API returns 204 No Content on successful POST (not 200), so check for status 204 rather than expecting a response body.

Two error conditions will affect production usage of the Dynamics 365 integration: token expiry (401 Unauthorized) and service-protection throttling (429 Too Many Requests). For 401 handling: in the Action Flow Editor on any API Call that reads Dynamics data, add a Conditional Action after the API Call. Check 'API Call Response → Status Code equals 401'. If true, call the `getToken` API Call to refresh the token, update `App State → dynamicsToken`, then retry the original Dynamics API Call. This silent refresh pattern keeps the user experience smooth without a visible login screen. For 429 handling: Dataverse returns HTTP 429 with a `Retry-After` header when you exceed roughly 6,000 requests per 5-minute window per user (verify current limits in Microsoft's documentation). In FlutterFlow, you can't read HTTP headers directly from an API Call response, so the practical approach is to avoid high-frequency polling. Set auto-refresh intervals no faster than every 30 seconds on any ListView that calls Dynamics, and show a user-friendly 'Too many requests — please wait a moment' message when you detect a 429 status code. For web builds of your FlutterFlow app, note that CORS must be handled at the server level — the Dataverse API itself may block cross-origin requests from a browser. Your Firebase Cloud Function already sets CORS headers in the example above, so token fetching is fine. However, if your Dynamics API Calls go directly from the browser to Dataverse, you may hit a CORS 'XMLHttpRequest error'. In that case, proxy ALL Dataverse calls through the Cloud Function (not just the token endpoint) for web builds. If this is a mobile-only app (iOS/Android), CORS is not a concern. If you'd rather skip building and maintaining the Cloud Function proxy yourself, RapidDev's team builds FlutterFlow integrations like this every week — get a free scoping call at rapidevelopers.com/contact.