JWT authentication in integrations when integrating ServiceNow with third party applications

[Community Alums]

Hi Experts,

We're doing an integration with Third party application into ServiceNow , Have to use JWT authentication for this.

I have checked the connectivity in POSTMAN, 
In the first step I'm getting Token which will expire in some time.

In the 2nd step ,I will be getting App Key, using the Bearer token generated in first step , App key will be the  permanent one and I will be using that for authorization bearer in next step

 In Step 3, In the URL I'm passing the asset serial number to get the asset detail from third party

Finally I'm able to get the response in POSTMAN,  

I have to set up this authentication , API calls in servicenow... Please suggest me the way that how can I set this in servicenow.

Thanks in advance,
Chaithanya

[Sainath N]

@Community Alums : These should be configured as three different REST message methods (similar to how you did in Postman) and should execute sequentially, as the output of the first call will be an input to the next call.

You can start retrieving these APIs in ServiceNow by navigating to System Web Services > Outbound > REST Message.

Please mark this as correct answer and helpful if it resolved, or mark this helpful if this help you to reach towards solution.

[Matt Bowler]

I am running into a similar use-case, but in the context of Discovery. An API I need to leverage for gathering CI data requires two-step authentication... do you know of any resources which may be helpful?

https://www.servicenow.com/community/developer-forum/customer-http-rest-api-discovery-with-two-stage...

[Randheer Singh]

Hi @Community Alums ,

for inbound integrations (3rd party system to SN) you can follow this document for configuring JWT bearer token-based authentication.

https://docs.servicenow.com/bundle/vancouver-platform-security/page/administer/security/task/create-jwt-endpoint.html

Thanks,

Randheer

[Matt Bowler]

@Randheer Singh-- how about the inverse, where SN needs to first obtain a token via a login request, then use the token in subsequent requests? I am trying to develop a custom discovery process that pulls information from a REST API, but that API requires the client to obtain and refresh a JWT token very often.

Thanks,

Matt