Salesforce Docs Portal

Configure OAuth for ServiceNow

ServiceNow provides an OAuth authorization code grant flow by using REST. This allows users to access resources by authenticating directly with an OAuth server, rather than authenticating with a username and password. We use this authorization code grant flow process when connecting between a ServiceNow instance and our services.

For more information, see OAuth authorization code grant flow.

  1. To set up OAuth in ServiceNow, make sure the OAuth Plugin is active, and the OAuth activation property is set to true.
  2. Sign into ServiceNow with an admin account. Go to System OAuth and click Application Registry.
  3. Click New and select New Inbound Integrations Experience. On the Connection Type list, click OAuth Authorization Code Grant.

    Input a Name, the Redirect URL, and optionally the Logo URL here.

    Leave Public Client unchecked to avoid an OAuth connection error.

  4. Make sure Own’s IPs are allowlisted.
  5. Create a Dedicated Auth Scope, check "Allow access only to APIs in selected scope", and limit authorization for the following APIs:
    • Attachment API
    • Aggregate API
    • Batch API
    • Table API
  6. In Advanced Options, set the below configurations:
    • Access Token Lifespan: 1,800 seconds

      Provides a 30-minute window for active session tokens.

    • Token Format: Opaque

      Backup & Recover uses the Authorization Code Grant (where an admin physically logs in to click "Allow"). An Opaque token is the native way ServiceNow handles that "handshake".

    • Refresh Token Lifespan: 2,147,483,647 seconds

      The default is 8,640,000 seconds or 100 days. This means that after 100 days, the client is required to reauthorize the OAuth connection. We recommend increasing this lifespan to a larger value to reduce manual reauthorization. The max value is 2,147,483,647 seconds (~68 years).

  7. Save your changes and copy both the Client ID and Client Secret. The Redirect URL has the below value:

    https://[OBRegion]/ts/servicenow/callback

    Region ID Callback URL
    app1 https://app1.owndata.com/ts/servicenow/callback
    useast2 https://app1.owndata.com/ts/servicenow/callback
    au1 https://au1.owndata.com/ts/servicenow/callback
    au4 https://au4.owndata.com/ts/servicenow/callback
    ca1 https://ca1.owndata.com/ts/servicenow/callback
    ca4 https://ca4.owndata.com/ts/servicenow/callback
    emea1 https://emea1.owndata.com/ts/servicenow/callback
    emea2 https://emea1.owndata.com/ts/servicenow/callback
    emea4 https://emea4.owndata.com/ts/servicenow/callback
    hipaa1 https://hipaa1.owndata.com/ts/servicenow/callback
    hipaa4 https://hipaa4.owndata.com/ts/servicenow/callback
    uk1 https://uk1.owndata.com/ts/servicenow/callback
    sg1 https://sg1.owndata.com/ts/servicenow/callback
    usgov2 https://usgov2.owndata.com/auth/servicenow/callback
  8. In Own, click New Service.
  9. Click the ServiceNow icon.
  10. On the “Authentication Method” select OAuth 2.0.
  11. Configure OAuth in ServiceNow as described earlier.
  12. Add the “Client ID” and “Client Secret” from ServiceNow into the relevant fields.
  13. Click Add Service.
  14. If MFA is enabled, authenticate by using MFA.
  15. When the OAuth token expires, reauthenticate by using the previous steps.

    To reduce reauthentication frequency, set the refresh token to the maximum value as described earlier.

  16. Log out and then log in to your ServiceNow instance with an admin account to turn on the connection with Own.

    Make sure that a user with the admin role is used to log in.

  17. A page shows a request to connect to a ServiceNow account. Click Allow.
  18. ServiceNow sends Own an authorization code and refresh token.

    Own uses that to validate and authorize a connection.