How to secure client details in ServiceNow.

[Vijay Baokar]

Hi Folks,

What is the best way to keep client ID and Secret secure in ServiceNow instance?

[Dr Atul G- LNG]

Hi @Vijay Baokar 

Could you clarify which context you're referring to? Are you asking about a specific module, data, dashboard, or integration or another area? 

https://www.servicenow.com/community/itsm-forum/how-to-know-my-instance-client-secret-and-client-id/...

https://www.servicenow.com/docs/bundle/vancouver-platform-security/page/administer/reference-pages/c...

[Nilesh Pol]

@Vijay Baokar 

ServiceNow provides an Encrypted Text data type that can be used to store sensitive information like Client IDs and Client Secrets securely.

• Go to System Definition > Dictionary.

• Create a new dictionary entry for a custom table where you will store the Client ID and Client Secret (e.g., u_credentials table).

• Define fields as Encrypted text for it.

If you mensioning about credentials. Use OAuth 2.0 Application Registry for securely managing OAuth credentials.

[Swapnil Shirsik]

I think the only users with security_admin role can fully access and manage the OAuth related things. So, one way could be to limit this role.

[Ankur Bawiskar · Accepted solution]

@Vijay Baokar 

2 ways

1) have field level READ ACL on those 2 Fields on OAuth App registry and show only when role is security_admin

OR

2) enable column level encryption and give encryption context, only users with that encryption context can see it

If my response helped please mark it correct and close the thread so that it benefits future readers.