How to properly mask and store client token here?

[Ravish Shetty]

Hello, 

Below is a cURL example of an API we are trying to hit.

curl --location 'https://my_custom_app.com/api/flo/123456789/invoke?clientToken=ABCD' \

--header 'Content-Type: application/json' \

--data-raw '{

    "userId" : "dummy@dummy.com ",

    "contextId" : "123456789"

}'

The API does not have any authentication and relies on using the confidential client token 'ABCD' which we are supposed to keep hidden. what is the best way to handle this? What I can think of is storing it in a system property.

Thanks,

Ravish

[Its_Azar]

Hi there @Ravish Shetty 

A System Property is a common approach, but for a confidential token I'd recommend using an encrypted System Property so the value isn't exposed in plain text.

Then retrieve it server-side (Script Include, REST Message, Flow Action, etc.) and append it to the request at runtime. Avoid hardcoding the token in scripts or exposing it to any client-side code.

If possible, I'd also ask the API provider to support a standard authentication mechanism (OAuth 2.0, API keys in headers, or Basic Auth), since passing a secret as a query parameter is not a great idea.

[marianbruma]

Hi  @Ravish Shetty ,

I think storing the token in an encrypted System Property is a reasonable approach, provided it's only ever accessed from server-side code (Script Include, REST Message, Flow Action, etc.) and never exposed to the client.

My only concern is that the API expects the token as a query parameter. Even if you store it securely in ServiceNow, URLs can end up in logs or monitoring tools. If you have any influence over the API, I'd recommend asking the provider to accept the token in a request header or, even better, support a standard authentication mechanism like OAuth.

If changing the API isn't an option, then an encrypted System Property (or a Credential/Connection Alias for a more structured integration) would be the way I'd go.

Hope that helps!

[Tanushree Maiti]

Hi @Ravish Shetty 

For one of our client we got the same use case. We implemented in following way:

1. Create a System Properties with Password2 type. When in value you will paste the token , it would be showing as masked even for Admin.

2. Decrypt this from any Servicer script.

For us - it was Workflow script.

Sample Server side script to decrypt it:

var propName = 'custom_app.client_token';  //update with your actual sys_property name

var encryptedValue = gs.getProperty(propName);

var encrypter = new GlideEncrypter();

var decryptedValue = encrypter.decrypt(encryptedValue);

gs.info('Decrypted Client Token: ' + decryptedValue);  //it will show your ABCD value.

Good luck!