---
schema_version: "1"
id: 64ff420b6d809c7616f49461e75699591da70310737b8b245f4e723e70b7d9ae
title: Configure OAuth for ServiceNow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/br_o_servicenow_config_oauth.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.br_o_servicenow_config_oauth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 745da2b80fa0cbf80ca40772e40e3063f1e6148a064140a8f8921042327c47be
description: ServiceNow provides an OAuth authorization code grant flow by using REST. This allows users to access resources by authenticating directly with an OAuth server, rather than authenticating with a username and password. We use this authorization code grant flow process when connecting between a ServiceNow instance and our services.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Configure OAuth for ServiceNow

ServiceNow provides an OAuth authorization code grant flow by using REST. This allows users to access resources by authenticating directly with an OAuth server, rather than authenticating with a username and password. We use this authorization code grant flow process when connecting between a ServiceNow instance and our services.

For more information, see [OAuth authorization code grant flow](https://www.servicenow.com/docs/bundle/zurich-platform-security/page/administer/security/concept/c_OAuthAuthorizationCodeFlow.html).

1. To set up OAuth in ServiceNow, make sure the OAuth Plugin is active, and the OAuth activation property is set to true.
2. Sign into ServiceNow with an admin account. Go to System OAuth and click Application Registry.
3. Click New and select New Inbound Integrations Experience. On the Connection Type list, click OAuth Authorization Code Grant.
    
    Input a Name, the Redirect URL, and optionally the Logo URL here.
    
    Leave Public Client unchecked to avoid an OAuth connection error.
4. Make sure Own’s IPs are allowlisted.
    
    For more information, see [Own Regional Locations and IP Addresses for Recover, Seeding, Anonymize, Archive Console, and Discover](https://help.salesforce.com/s/articleView?id=platform.platform_o_aws_regions_for_allowlist.htm&release=264.0.0&type=5 "When you limit network traffic to Salesforce, add these IP addresses to the list of Login IP Ranges. This will let Own connect to your environment.").
5. Create a Dedicated Auth Scope, check "Allow access only to APIs in selected scope", and limit authorization for the following APIs:
    
    - Attachment API
    - Aggregate API
    - Batch API
    - Table API
6. In Advanced Options, set the below configurations:
    
    - Access Token Lifespan: 1,800 seconds
        
        Provides a 30-minute window for active session tokens.
    - Token Format: Opaque
        
        Backup & Recover uses the Authorization Code Grant (where an admin physically logs in to click "Allow"). An Opaque token is the native way ServiceNow handles that "handshake".
    - Refresh Token Lifespan: 2,147,483,647 seconds
        
        The default is 8,640,000 seconds or 100 days. This means that after 100 days, the client is required to reauthorize the OAuth connection. We recommend increasing this lifespan to a larger value to reduce manual reauthorization. The max value is 2,147,483,647 seconds (~68 years).
7. Save your changes and copy both the Client ID and Client Secret. The Redirect URL has the below value:
    
    https://\[OBRegion\]/ts/servicenow/callback
    
    | Region ID | Callback URL |
    | --- | --- |
    | app1 | `https://app1.owndata.com/ts/servicenow/callback` |
    | useast2 | `https://app1.owndata.com/ts/servicenow/callback` |
    | au1 | `https://au1.owndata.com/ts/servicenow/callback` |
    | au4 | `https://au4.owndata.com/ts/servicenow/callback` |
    | ca1 | `https://ca1.owndata.com/ts/servicenow/callback` |
    | ca4 | `https://ca4.owndata.com/ts/servicenow/callback` |
    | emea1 | `https://emea1.owndata.com/ts/servicenow/callback` |
    | emea2 | `https://emea1.owndata.com/ts/servicenow/callback` |
    | emea4 | `https://emea4.owndata.com/ts/servicenow/callback` |
    | hipaa1 | `https://hipaa1.owndata.com/ts/servicenow/callback` |
    | hipaa4 | `https://hipaa4.owndata.com/ts/servicenow/callback` |
    | uk1 | `https://uk1.owndata.com/ts/servicenow/callback` |
    | sg1 | `https://sg1.owndata.com/ts/servicenow/callback` |
    | usgov2 | `https://usgov2.owndata.com/auth/servicenow/callback` |
8. In Own, click New Service.
9. Click the ServiceNow icon.
10. On the “Authentication Method” select OAuth 2.0.
11. Configure OAuth in ServiceNow as described earlier.
12. Add the “Client ID” and “Client Secret” from ServiceNow into the relevant fields.
13. Click Add Service.
14. If MFA is enabled, authenticate by using MFA.
15. When the OAuth token expires, reauthenticate by using the previous steps.
    
    To reduce reauthentication frequency, set the refresh token to the maximum value as described earlier.
16. Log out and then log in to your ServiceNow instance with an admin account to turn on the connection with Own.
    
    Make sure that a user with the admin role is used to log in.
17. A page shows a request to connect to a ServiceNow account. Click Allow.
18. ServiceNow sends Own an authorization code and refresh token.
    
    Own uses that to validate and authorize a connection.