The communication scheme looks as follows:

The SAP S/4HANA will first send a request to a configured BTP destination. This destination will be bound to a dedicated CMIS repository inside BTP that acts as a proxy to the CMIS repository in the Fabasphere. In order to connect to the Fabasphere, a corresponding destination should also be configured in BTP.
In order to create that “proxy” CMIS repository and to provide a way for SAP S/4HANA to communicate with BTP, a special Service Key must be created and associated with the previously created Document Management Instance.
This Service Key will contain the necessary credentials for the OAuth 2.0 Client Credentials authentication flow.