Join the #BuildWithBuildAgent Challenge! Get recognized, earn exclusive swag, and inspire the ServiceNow Community with what you can build using Build Agent.  Join the Challenge.

Authentication for Google A2A – ServiceNow as Secondary Agent

warren_chan
ServiceNow Employee
ServiceNow Employee

7 hours ago

As part of our December 2025 release of Now Assist AI Agents, we’re introducing AI agent interoperability over the Google Agent2Agent protocol. Follow the below instructions to set up your ServiceNow AI Agents as secondary agents (acting as A2A server).

 

Instance Requirements

  • Platform version:
    • Yokohama Patch 11+ (January 2026)
    • Zurich Patch 4+ (December 2025)
  • Application version:
    • Now Assist AI Agents 6.0.x+ (December 2025 release)

Application Settings

  • Turn on external agents (AI Agent Studio > Settings)
    • Allow ServiceNow to access External AI agents:
      • Set sn_aia.external_agents.enabled: true
    • Allow third party to access ServiceNow AI Agents:
      • Set sn_aia.internal_agents.enabled_external: true

warren_chan_0-1765307343327.png

Service Account/User Setup

  • Create service/user account in User [sys_user] table
    • Make sure user is Active: true
    • Password needs reset: false
    • Locked out: false
  • Assign role to run ServiceNow AI Agents
    • sn_aia.integration (recommended – basic run time access)
    • sn_aia_admin (testing only – full AI Agent write/create access)
  • Assign any necessary application roles (e.g., itil)
  • Assign any necessary integration roles
    • rest_service
    • snc_platform_rest_api_access

Select the AI Agent

  • Get the sys_id of one of your AI agents to prepare to make the A2A API call
    • Go to All > AI Agent Studio > Create and manage
    • Select AI agents list.
    • Select your AI agent.
  • Take note and copy the sys_id of the AI agent from the browser bar. Alternatively, you can navigate to the AI Agents [sn_aia_agent] table and copy the sys_id from the AI agent record row directly:

warren_chan_1-1765307410902.png

 

  • In addition, ensure that Enable this AI agent for discovery is toggled on for your AI Agent. This sets the associated AI Agent Config [sn_aia_agent_config] record’s External discoverable value to be true.
  • Under Select channels and status, ensure that your AI agent is Active.

warren_chan_2-1765307436233.png

 

(For Postman or for testing with no callback) Messaging Channel

  • If testing with Postman or curl command and you do not have a functional callback URL, then you must set your Messaging Channel to Synchronous.
  • Go to Messaging Channels [sys_cs_channel] list.
  • Add Synchronous field to your personalized list columns.
  • If necessary, switch to the Now Assist AI Agents application scope.
  • Set the value for AI Agent A2A Channel record to be Synchronous is true:

warren_chan_3-1765307529831.png

  • For asynchronous scenarios (recommended for user experience and performance), set up a callback URL in the External Agent Push Notification [sn_aia_ea_push_notification_url] table.

(Informational) AI Agent A2A API

  • To view the Scripted REST API for A2A, go to All > System Web Services > Scripted REST APIs
  • Select AI Agent A2A API:

warren_chan_4-1765307565431.png

  • Go the Resources related list. These are the Scripted REST Resources (endpoints) of the A2A Scripted REST API:

warren_chan_5-1765307589364.png

  • As of the Google A2A 0.3.0 version alignment, the Scripted REST Resource Agent Card - Direct Discovery is marked as Requires authentication = false. Change this to true if you want to require authentication for the Agent Card Direct Discovery.
  • Note that our test examples will execute a GET on the Agent Card. If Requires Authentication = false, then it’s not really a valid authentication test. Set Requires Authentication = true to test the authentication.
  • Also note that ServiceNow A2A has separate endpoints for Agent Card discovery and Agent Execution. Additionally, as of December 2025, there is a V2 version for each endpoint:
    • (GET) Agent Card V1: /api/sn_aia/a2a/id/{agent_id}/well_known/agent_json
    • (GET) Agent Card V2: /api/sn_aia/a2a/v2/agent_card/id/{agent_id}
    • (POST) Agent Execution V1: /api/sn_aia/a2a/v1/agent/id/{agent_id}
    • (POST) Agent Execution V2: /api/sn_aia/a2a/v2/agent/id/{agent_id}

Create Application Registry for OAuth Endpoint

  • Go to System OAuth > Application Registry.
  • Select New.
  • Select Create an OAuth API endpoint for external clients:

warren_chan_6-1765307627149.png

  • On the new Application Registry form:
    • Enter a Name (e.g., A2A OAuth External Agents)
    • Client ID field will be automatically populated.
    • Upon saving, the Client Secret field will be automatically generated as well.
  • Under Auth Scopes mapping, add the a2aauthscope record.

warren_chan_7-1765307652599.png

  • Save the Application Registry record.

Authentication Profiles OAuth

  • Go to System Web Services > API Access Policies > Inbound Authentication Profile
  • Create New (or modify existing OAuth in External AIA for A2A policy)
  • Select Type is OAuth, and pick the OAuth Entity that you created before:

warren_chan_8-1765307682158.png

For OAuth with Authorization (Bearer) Token

  • On the Application Registry record, set the following fields:
    • Client Type: Integration as a Service
    • Default Grant type: Authorization Code
    • Redirect URL: https://<your instance name>.service-now.com/login.do
    • Active: true

warren_chan_9-1765307720306.png

 

  • In Postman, construct a GET request, like this:
    • Method: GET
    • URL: https://<your instance name>.service-now.com/api/sn_aia/a2a/id/<your AI Agent ID>/well_known/agent_json
    • Auth Type: OAuth 2.0
    • Add authorization data to: Request Headers
    • Token: (empty until you pull a token)
    • Header Prefix: Bearer
    • Token Name: <enter a name for your token>
    • Grant type: Authorization Code
    • Callback URL: https://<your instance name>.service-now.com/login.do
    • Authorize using browser: false, unchecked
    • Auth URL: https://<your instance name>.service-now.com/oauth_auth.do
    • Access Token URL: https://<your instance name>.service-now.com/oauth_token.do
    • Client ID: <your Client ID value from the Application Registry record in ServiceNow>
    • Client Secret: <your Client Secret value from the Application Registry record in ServiceNow>
    • Scope: (leave blank, response should select a2aauthscope by default)
    • State: <enter some random value, but keep it unique between each request send>
    • Client Authentication: Send as Basic Auth header
    • Refresh Token URL: (will be populated automatically by other fields)

warren_chan_10-1765307747786.png

warren_chan_11-1765307777325.png

warren_chan_12-1765307796524.png

warren_chan_13-1765307818078.png

 

  • In Postman, select the Get New Access Token button
  • This will create a new popup modal window

warren_chan_14-1765307843007.png

  • It will redirect to a ServiceNow login page. Enter the credentials of your username and password that you would like to use for this connection:

warren_chan_15-1765307861673.png

 

  • You will receive a prompt asking to deny or allow the request. Choose Allow:

warren_chan_16-1765307890436.png

 

  • If successful, you will receive a confirmation message like this:

warren_chan_17-1765307911707.png

  • Then Postman will display your access and refresh tokens. Select Use Token to continue the request process in Postman:

warren_chan_18-1765307930771.png

 

  • The token details will be automatically populated in the Token section of your Postman request:

warren_chan_19-1765307953106.png

  • In Postman, select Send to send the request:

warren_chan_20-1765307974875.png

 

  • Verify that you get a 200 OK response in the console, with the Agent Card returned for the AI Agent sys_id that you selected.

warren_chan_21-1765308000645.png

 

  • cURL command alternate:
curl --location 'https://<your instance name>.service-now.com/api/sn_aia/a2a/id/<your AI Agent ID>/well_known/agent_json' \
--header 'Authorization: Bearer <your OAuth token>' \

 

For OAuth with Client Credentials

warren_chan_0-1765309012801.png

 

  • On the ServiceNow Application Repository form, add the following fields to the form:
    • Default Grant Type [default_grant_type]
    • OAuth Application User [user]
  • On the Application Repository record, set the following:
    • Default Grant Type: Client Credentials
    • OAuth Application User: <select the user account you want to use>
    • Active: true
    • Remaining fields can be the same as OAuth for Authorization Code setup

warren_chan_1-1765309039496.png

 

  • In Postman, construct the following request, very similar to the previous section for OAuth for Authorization Code.
    • Grant type: Client Credentials
    • Client Authentication: Send as Basic Auth header

warren_chan_2-1765309060713.png

 

  • The remaining steps are the same as OAuth for Authorization Code:
    • In Postman, select the Get New Access Token button
    • This will create a new popup modal window.
    • If the session is currently unauthenticated, it will redirect to a ServiceNow login page.
    • Enter the credentials of your username and password that you would like to use for this connection:
    • You will receive a prompt asking to deny or allow the request. Choose Allow.
    • Then Postman will display your access and refresh tokens. Select Use Token to continue the request process in Postman.
    • The token details will be automatically populated in the Token section of your Postman request:

warren_chan_3-1765309086436.png

 

  • In Postman, select Send to send the request.
  • Verify that you get a 200 OK response in the console, with the Agent Card returned for the AI Agent sys_id that you selected.

For OAuth with Resource Owner Password Credentials

  • Very similar setup to above steps in OAuth for Authorization Code and OAuth for Client Credentials
  • In ServiceNow Application Registry record, set the following:
    • Default Grant type: Resource Owner Password Credentials
  • In Postman, add the following to your request:
    • Grant type: Password Credentials
    • Username: <your user record’s username>
    • Password: <your user account’s password>

warren_chan_4-1765309115712.png

 

For Federated Token Authentication

API Key for Authentication

  • Go to All > System Web Services > API Access Policies > Inbound Authentication Profiles
  • Select New
  • Select Create API Key authentication profiles
    • Name: <enter a name>
    • Auth Parameter: x-sn-apikey (for Type = Auth Header)

warren_chan_5-1765309163646.png

 

warren_chan_6-1765309185865.png

 

  • Go to All > System Web Services > API Access Policies > REST API Key
  • Select New
  • Fill in the following fields:
    • Name
    • Description
    • User: <select your user/service account>
    • Auth Scope: a2authscope
  • Save or update
  • Your API key will be generated in the Token field

warren_chan_7-1765309216675.png

 

API Access Policies (for OAuth or API Key)

  • Go to System Web Services > API Access Policies > REST API Access Policies
  • Select AI Agent A2A API Access Policy
  • Under Inbound authentication profiles, add your Authentication Profile from above in the list

warren_chan_8-1765309235638.png

 

Testing API Key for Authentication

  • Open Postman
  • Create a new GET request:
    • Method: GET
    • URL: https://<your instance name>.service-now.com/api/sn_aia/a2a/id/<your AI Agent ID>/well_known/agent_json
    • Under Headers, add:
      • x-sn-apikey: <your API key you generated>
    • In Postman, select Send to send the request.
    • Verify that you get a 200 OK response in the console, with the Agent Card returned for the AI Agent sys_id that you selected.

warren_chan_9-1765309261252.png

 

  • cURL command alternate:
curl --location 'https://<your instance name>.service-now.com/api/sn_aia/a2a/id/<your AI agent ID>/well_known/agent_json' \
--header 'x-sn-apikey: <your API key you generated>'

 

Testing API Key with another ServiceNow Instance

  • On the A2A client ServiceNow instance, login as an Admin.
  • Go to IntegrationHub > Connections & Credential Aliases.
  • Select New.
    • Fill in the following fields:
      • Name: <enter name of your connection>
      • Type: Connection and Credential
      • Connection type: HTTP
      • Default Retry Policy: Default HTTP Retry Policy
      • Configuration Template: (none)
    • Save the Connection Alias record.
    • In Connections related list, select New.
      • Fill in the following fields:
        • Name: <enter name of your connection>
        • Credential: (empty for now)
        • Connection alias: <select parent Connection Alias record>
        • Connection URL: https://<your A2A server instance name>.service-now.com/api/sn_aia/a2a/id/<your AI Agent ID>/well_known/agent_json
        • Active: true
      • Save the Connection record.
      • Go to IntegrationHub > Credentials.
      • Select New.
      • Create a new record, like this:
        • In the interceptor, select Secondary Bot Static Token Credential. This gives us the headers that we need to authenticate with a REST API key.
        • Fill in the following fields:
          • Name: <enter name of your credential>
          • Active: true
          • Header: x-sn-apikey
          • Static Token: <your API key you generated in the other instance>
          • Authorization Algorithm: Second Bot Static Token Auth
          • Type: sn_va_as_service_static_token
          • Credential alias: <none>
        • Save the Credential record.

warren_chan_10-1765309311294.png

 

  • On the parent Connection record, select the created Credential in the Credential field.
  • Save the Connection record.
  • In A2A client ServiceNow instance, go to AI Agent Studio > Create and manage.
  • Go to the AI agents sub-list.
  • Select the Add dropdown, and pick External.
  • Select Agent2Agent (A2A) Protocol in the popup modal.
  • Walk through the guided setup and choose your above Connection Alias as your external provider.
  • If necessary, repeat the process for Agent Execution Connection Alias.

Testing OAuth 2.0 with another ServiceNow Instance

  • Prerequisites:
    • Make sure your Application Registry record for OAuth is created on your A2A server ServiceNow instance (see earlier steps).
  • On A2A client ServiceNow instance, login as an Admin.
  • Go to System OAuth > Application Registry.
    • Select Connect to a third party OAuth Provider – Outbound:

warren_chan_11-1765309345143.png

 

  • Fill in the following fields:
    • Name: <enter name of your Application Registry>
    • Client ID: <same Client ID from A2A server ServiceNow’s Application Registry>
    • Client Secret: <same Client Secret from A2A server ServiceNow’s Application Registry>
    • OAuth API Script: (empty)
    • Default Grant type: <matches value from A2A server ServiceNow’s Application Registry>
    • Active: true
    • Authorization URL: <A2A server ServiceNow instance>.service-now.com/oauth_auth.do
    • Token URL: <A2A server ServiceNow instance>.service-now.com/oauth_token.do
    • Token Revocation URL: (empty)
    • Redirect URL: <this A2A client ServiceNow instance>.service-now.com/oauth_redirect.do
  • Save the Application Registry record. The OAuth Entity Profiles section should automatically generate a record.

warren_chan_12-1765309375167.png

 

  • On A2A server ServiceNow instance, login as an Admin.
  • Go to System OAuth > Application Registry.
  • Select your Application Registry you created as a prerequisite.
    • Set the Redirect URL to the same as what you had created in the A2A client ServiceNow instance.
    • Save the Application Registry record.

warren_chan_13-1765309404579.png

 

  • Return to your A2A client ServiceNow instance.
  • Go to IntegrationHub > Connections & Credential Aliases.
  • Select New.
    • Fill in the following fields:
      • Name: <enter name of your connection>
      • Type: Connection and Credential
      • Connection type: HTTP
      • Default Retry Policy: Default HTTP Retry Policy
      • Configuration Template: (none)
  • Save the Connection Alias record.
  • In Connections related list, select New.
    • Fill in the following fields:
      • Name: <enter name of your connection>
      • Credential: (empty for now)
      • Connection alias: <select parent Connection Alias record>
      • Connection URL: https://<your A2A server instance name>.service-now.com/api/sn_aia/a2a/id/<your AI Agent ID>/well_known/agent_json
      • Active: true
  • Save the Connection record.
  • Go to IntegrationHub > Credentials.
  • Select New.
  • Create a new record, like this:
    • In the interceptor, select OAuth 2.0 Credentials.
    • Fill in the following fields:
      • Name: <enter name of your Credential>
      • Active: true
      • OAuth Entity Profile: <select OAuth default_profile generated from Application Registry record>
      • Integration Type: System
    • Save the OAuth 2.0 Credential record.
  • On the parent Connection record, select the created Credential in the Credential field.
  • Save the Connection record.
  • Return to the Credential record.
  • In the Related Links, select the Get OAuth Token button:

warren_chan_14-1765309539666.png

 

  • If grant type is Authorization Code, you should receive a popup like this:

warren_chan_15-1765309563965.png

 

  • Select the Allow button.
  • If necessary, login into the A2A server instance via the popup window.
  • On the OAuth 2.0 Credential record, the token should show as available, with an expiration date:

warren_chan_16-1765309583979.png

 

  • In A2A client ServiceNow instance, go to AI Agent Studio > Create and manage.
  • Go to the AI agents sub-list.
  • Select the Add dropdown, and pick External.
  • Select Agent2Agent (A2A) Protocol in the popup modal.
  • Walk through the guided setup and choose your above Connection Alias as your external provider.
  • If necessary, repeat the process for Agent Execution Connection Alias.

Debug and Troubleshooting

  • Setting these system properties may help when you review logs:
    • com.snc.platform.security.oauth.debug: true
    • glide.auth.debug.enabled: true
  • Flow Designer reporting (Flow Designer > Flow Administration > Settings)
    • A2A Flows:
      • External AI Agent Card – A2A Protocol
      • External AI Agent Provider – A2A Protocol
      • AI Agent A2A Message Responder
    • Settings (for sub-production/development only):
      • Reporting: Trace
      • Logging: Debug
    • Tables with meaningful data:
      • Execution Plan [sn_aia_execution_plan]
      • External Agent Execution History [sn_aia_external_agent_exec_history]

 

 

 

 

 

 

0 Helpfuls
  • 82 Views
Version history
Last update:
Tuesday
Updated by:
ServiceNow Employee
Contributors