How to generate bearer token for OAuth 2.0 - Authorization Code Grant type - Support and Troubleshooting

How to generate bearer token for OAuth 2.0 - Authorization Code Grant type Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The Now Platform supports OAuth 2.0 - Authorization Code Grant type for public clients to generate an access token . This requires 3 steps.

Register the app Generate Authorization Code Generate Bearer Token using Authorization Code. Use Case Use Access Token to access Table API or Scripted Web Service .

Register the app Navigate to System oAuth > Application Registry > Create an OAuth API endpoint for external clients

Name Definition Name Name of the registered app Client ID client id of the registered app Client Secret client secret of the registered app Redirect URI Authorization code is returned to this URI. This is usually the endpoint of the registered app. The screenshot has login.do for demo purposes Authorization Code Life Span The lifespan of the authorization code. Extend the lifespan if required. It expires in 60 seconds by default. (To edit either add auth_code_lifespan field to the form or the columns on the list view then increase to integer more than 60) Access Token Life Span The lifespan of the access token Refresh Token Life Span The lifespan of the refresh token Generate Authorization Code Authorization code requires a user login . Use these steps to generate an authorization code.

Access the authorization endpoint . This requires response type , redirect uri , and client id: Sample edit this URL to match the above and put it in your browser:

https:// .service-now.com/oauth_auth.do?grant_type=authorization_code&redirect_uri=https:// .service-now.com/login.do&client_id= &response_type=code&state=123 See the following for more info: Authorization code flow state parameter requirement

The user is redirected to oauth login page: /oauth_login.do

Enter valid credentials. [Ensure the user has permissions to read/write on the oauth_credential table or use "admin" account to override ACL issues]

User needs to either Allow/Deny the request.

Authorization code is returned to redirect uri after clicking Allow will show up in the browser URL and look like the following: https:// .service-now.com/login.do?code=iz8efjPNK-4Q_ZOS3DcEqcJa9oXo1uLhpItv30PhaeknEfGWMF2haVCpYwGLg7cXzVpYqkMnkHF242VuFe8ZCQ&state=123

Authorization code is valid for 60 seconds by default so if you take too long to do the next steps just redo steps 2-5 to get new code. You can increase this value from Application Registry you created on the list view or form after adding the auth_code_lifespan field to the form

Copy the code as this will be used in the next steps

Generate Bearer Token oauth_token.do supports post ( form url encoded ) to generate an access token. This requires code , redirect uri , client id , client secret , and grant type to generate an access token.

Then either use Postman or cURL can be used to post the request.

Postman - Example

POST

https:// .service-now.com/oauth_token.do Body [x-www-form-urlencoded]

Update "redirect_uri", "grant_type", "code", "client_secret" & "client_id" here: Curl:

curl -d "grant_type=authorization_code&code= &client_id= &client_secret= &redirect_uri=https:// .service-now.com/login.do" https:// .service-now.com/oauth_token.do Sample Output:

{ "access_token": "SFgoFLvSiNVIwtU9O1U0hNsk2PaogKYkyg2KtnoilUmmeliibScwAG8A1vQlXODllLvHhcD1", "refresh_token": "GyLc-OX2Jd-NHpMpQUJbIcOhgqkQu-WoWhqNX68xouWV47Mn2TKqGU12EDsUoShND", "scope": "", "token_type": "Bearer", "expires_in": 1799 }

Facts .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Any Client ID / Client Secret / Authorization codes here are sample data not connected to any real endpoints make sure you are using the correct ones for your environment

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Any

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Verify all the required parameters are passed to resolve the error. Afterwards you can use the access token to do other API calls until it expires.

If you get an error during the call such as "access_denied" please do the following:

Test the same username/password for logging into the UI, ensure it does not require MFA If user used for OAuth call can login without issues using local login move to next step. Otherwise correct this behavior.

Test the OAuth call with a user that can do the above which has the admin role, if it works for an admin user but not another user it lacks sufficient roles to pull and OAuth token. Try adding addition roles such as: snc_internal, web_service_admin, oauth_admin, etc... If issue is not with roles check the Auth Scope set on the application registry Related Links .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } RFC: https://tools.ietf.org/html/rfc6749#section-1.3.1