Configuring JWT Bearer Authentication (ServiceNow As Token Provider) - Support and Troubleshooting

Configuring JWT Bearer Authentication (ServiceNow As Token Provider) Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } JWT Bearer authentication (RFC 7523) enables external applications to authenticate with ServiceNow without using a username and password. Instead, the client generates a digitally signed JSON Web Token (JWT), which ServiceNow validates before issuing an OAuth access token.

Unlike the Authorization Code or Client Credentials grant types, JWT Bearer authentication relies on asymmetric cryptography. The client signs the JWT using its private key, while ServiceNow verifies the signature using the corresponding public certificate configured in the platform.

The overall authentication flow consists of the following steps:

Generate an RSA Key Pair. Create an OAuth JWT API Endpoint for External Clients. Create a JWT Verifier Map. Upload the Public Certificate. Generate and Sign the JWT Assertion. Exchange the JWT Assertion for an OAuth Access Token.

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Any

Related Links .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Step 1 — Generate an RSA Key Pair JWT Bearer authentication relies on asymmetric encryption. The external application holds the private key (used to sign assertions) and shares only the public key with ServiceNow (used for signature verification only).

Run the following command to generate a Java KeyStore:

keytool -genkey -alias snclient -keyalg RSA -validity 365 \ -keystore snclient.keystore \ -storepass abcd1234 \ -keypass abcd1234 Property Value Output file snclient.keystore Store password abcd1234 (replace in production) Key password abcd1234 (replace in production) ⚠️ Security Note: The passwords above are examples only. Use strong, unique passwords in any non-development environment.

Step 2 — Create an OAuth Application Registry Navigate to: System OAuth → Application Registry → New

Select the type: OAuth JWT API endpoint for external clients

This record represents the external application that will authenticate using the JWT Bearer grant.

Public Client Field — Important The Public Client checkbox controls whether ServiceNow expects a client_secret in token requests.

Setting Behavior Unchecked (default) ServiceNow requires a client_secret . Used for server-side integrations where secrets can be stored safely. Checked No client_secret is expected or required. In this grant type, trust is established entirely through the signed JWT assertion. If the client application does not send a client_secret in the token request, the Public Client option must be enabled in the OAuth Application Registry. Otherwise, ServiceNow expects a client_secret and the token request will fail.

Step 3 — Create a JWT Verifier Map Navigate to: Application Registry record (created in Step 2) → Related Lists → JWT Verifier Maps → New

The JWT Verifier Map tells ServiceNow how to validate incoming JWT assertions. It links the OAuth Application Registry to the public certificate that will be used for signature verification.

Step 4 — Upload the Public Certificate Open the JWT Verifier Map created in Step 3 and upload the public certificate exported from the keystore generated in Step 1.

How verification works at runtime:

Client signs JWT with private key ↓ ServiceNow receives the assertion ↓ Locates the JWT Verifier Map ↓ Validates signature using the uploaded public certificate ↓ Access token issued Because only the matching private key could have produced a valid signature, this process confirms both the authenticity and integrity of the assertion.

Step 5 — Construct the JWT Assertion A JWT has three parts: Header, Payload, and Signature.

Header json { "alg": "RS256", "typ": "JWT" } Payload json { "iss": "client ID", "sub": "integration.user", "aud": "client ID", "iat": issuedat, "exp": expiresat, "jti": "Random Unique ID" } Claim Description iss OAuth Client ID from the Application Registry sub ServiceNow username the token will be issued for aud OAuth Client ID from the Application Registry (same as iss ) exp Expiration timestamp — keep this short (a few minutes) iat Issued At timestamp jti Unique identifier per assertion; prevents replay attacks The exp/iat values are typically in UNIX TIMESTAMP (Eg: 1752756000)

Step 6 — Exchange the JWT for an Access Token Submit a POST request to: POST https:// .service-now.com/oauth_token.do

Request body (form-encoded):

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer assertion= client_id=

A successful response returns a standard OAuth access token that can be used in subsequent API calls.