Password sharing with SFTP third party users

[Deepanshu Grov1]

Hi 🙂

We have a Use-Case where I am trying to resolve this via ServiceNow, need some inputs if we can do it!

Currently, We create SFTP link and users/passwords in the SFTP system and then send the password information via emails to them. 

Is there any way, we could save that information in the ServiceNow and send the link to those users via ServiceNow and they could click on the link and retrive the ID/password which we have already saved from SFTP. 

It is basically, we need a link which is active for onetime retrival only and help them to login into SFTP. 

[sreeram_nair]

You can do this in ServiceNow, but it requires a custom implementation that combines secure data storage, one-time token generation, and limited link access. 

Do this by securely storing the SFTP credentials (username and password) in an encrypted custom table, then generating a one-time retrieval link that’s emailed to the user.

When the user clicks the link, a scripted page checks if the token is valid and unused, then displays the credentials once and marks the link as expired. This ensures the data is securely stored, retrieved only once, and never sent directly by email.

• Create a custom encrypted table – Store SFTP usernames and passwords securely using encrypted text fields.

• Add token and expiry fields – Include fields for a unique token, expiry date, and a “retrieved” flag.

• Generate a token – When credentials are created, generate a GUID token (e.g., with gs.generateGUID()).

• Build a one-time URL – Create a link like https://<instance>.service-now.com/x_sftp_retrieve.do?sysparm_token=<token>.

• Send the link via notification – Email the user only the secure link, not the credentials themselves.

• Create a retrieval page (UI Page/Scripted Page) – This page validates the token, expiry, and “retrieved” flag.

• Display credentials once – If valid, decrypt and show the credentials, then set the “retrieved” flag to true.

• Expire the token – Prevent further use by marking the record as retrieved or deleting the credentials.