Integrations · LessonBy Sneha I, ServiceNow Trainer, 8 yrs · Published · ServiceNow · all levels
OAuth 2.0
Set up OAuth providers and clients, choose the right grant, and rotate secrets safely.
Quick answer
Set up OAuth providers and clients, choose the right grant, and rotate secrets safely.
Key takeaways
- Inbound uses an application registry, outbound uses a provider record
- Prefer JWT or client credentials for system to system
- Keep secrets in credentials, not in code
- Plan rotation and token lifetime up front
Inbound versus outbound
Inbound OAuth lets an external system authenticate to ServiceNow: create an OAuth application registry entry of type endpoint for client, and the client uses client id, secret and a user grant. Outbound OAuth lets ServiceNow call a protected API, using a provider entry with token and authorisation URLs.
Choosing a grant
Authorisation code when a user identity is involved. Client credentials or JWT bearer for system to system, which is what most integrations need. Password grant still exists and should be avoided for new work.
Operating it
Tokens and secrets need lifecycle management.
- Store secrets in credential records, never in a script or property
- Set token lifetimes deliberately, long lived tokens are a risk
- Plan rotation before go live and document who owns the credential
- Watch for clock skew, JWT assertions fail when the instance and provider disagree on time
Practice challenge
+0 XPStreak ×0
Question 1 of 2
Which grant suits a nightly server to server sync?
Frequently asked questions
Can one integration use basic auth instead?
It works, and it means a shared password crossing the network on every call. OAuth with a dedicated client is the better default.
Where do refresh tokens live?
In the OAuth credential record. Their lifetime is set on the application registry and expiry causes silent integration failures if nobody monitors it.