OAuth Implicit Grant Type Restrictions Starting Australia ReleaseSummary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Post upgrading to the Australia release, when trying to utilize the OAuth Implicit Grant Type, you may get an error saying 'Invalid Request' OAuth Implicit Grant is a simplified OAuth 2.0 flow designed for browser-based apps with no backend server, where the client requests response_type=token, and the authorization server returns the access token directly in the redirect URL fragment, skipping the separate code exchange step.This is available under the standard Authorization Code Grant type For example, trying to use the instance URL in the format below for the Redirect URL and the Client ID configured as per the Application Registry throws an Invalid Request instead of fetching the token for the user session https://instancename.servicenow.com/oauth_auth.do?response_type=token&redirect_uri={the_redirect_url}&client_id={the_client_identifier} For this specific grant type, the Implicit property below is added as an additional security measure in the Australia Release, so it only allows Client IDs from the command-separated values present in the property. Since now, (Cross Origin Resource Sharing) CORS support is universal, OAuth clients don’t need to use the implicit grant, and implicit grant type requests fail by default. If any of the integrations are still using this grant type, then you would have to create the below property with type as String and provide the Client ID of the specific application registry that is using this grant typeglide.oauth.clients.allowed.for.implicit.granthttps://www.servicenow.com/docs/r/platform-security/instance-security-hardening-settings/sc-prevent-oauth-clients-from-using-implicit-grant.html Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Documentation for reference: https://www.servicenow.com/docs/r/yokohama/platform-security/authentication/c_OAuthImplicitGrants.html https://www.servicenow.com/docs/r/platform-security/instance-security-hardening-settings/sc-prevent-oauth-clients-from-using-implicit-grant.html