https://www.servicenow.com/community/community-central-forum/accessing-api-key-stored-in-external-vault-cyberark-ccp-from/m-p/3601769#M7944 <DIV><P>I have a requirement where an API key is stored in an external CCP vault (for example, CyberArk), and ServiceNow has a corresponding credential record in the <STRONG>discovery_credential</STRONG> table.</P><P>The actual API key is not stored in ServiceNow. Instead, the credential record contains the credential reference/ID, and during execution the MID Server resolves the secret from the vault and injects it into the REST request (Authorization header).</P><P>This setup works successfully in <STRONG>Flow Designer</STRONG>, where the credential is resolved automatically.</P><P>However, I now need to call the same API from a <STRONG>Script Include</STRONG> as part of a custom integration and I'm not sure what the recommended approach is.</P><P>If the credential were stored directly in ServiceNow, I could use credential provider APIs such as sn_cc.StandardCredentialsProvider. But since the secret resides in the external vault and only the credential reference exists in ServiceNow, I'm unsure how to retrieve or use it in script.</P><P>My questions are:</P><OL><LI>How can I use a vault-backed credential from a Script Include?</LI><LI>Is there a supported API to resolve the secret at runtime from the credential record?</LI><LI>Should I be using a Connection &amp; Credential Alias instead of directly accessing the credential?</LI><LI>Does anyone have an example of making a REST call from script using a credential whose secret is stored in CyberArk/CCP?</LI></OL><P>Any guidance or best practices would be greatly appreciated.</P></DIV> Thu, 24 Sep 2026 10:21:35 GMT bandarunave 2026-09-24T10:21:35Z https://www.servicenow.com/community/community-central-forum/accessing-api-key-stored-in-external-vault-cyberark-ccp-from/m-p/3601769#M7944 <DIV><P>I have a requirement where an API key is stored in an external CCP vault (for example, CyberArk), and ServiceNow has a corresponding credential record in the <STRONG>discovery_credential</STRONG> table.</P><P>The actual API key is not stored in ServiceNow. Instead, the credential record contains the credential reference/ID, and during execution the MID Server resolves the secret from the vault and injects it into the REST request (Authorization header).</P><P>This setup works successfully in <STRONG>Flow Designer</STRONG>, where the credential is resolved automatically.</P><P>However, I now need to call the same API from a <STRONG>Script Include</STRONG> as part of a custom integration and I'm not sure what the recommended approach is.</P><P>If the credential were stored directly in ServiceNow, I could use credential provider APIs such as sn_cc.StandardCredentialsProvider. But since the secret resides in the external vault and only the credential reference exists in ServiceNow, I'm unsure how to retrieve or use it in script.</P><P>My questions are:</P><OL><LI>How can I use a vault-backed credential from a Script Include?</LI><LI>Is there a supported API to resolve the secret at runtime from the credential record?</LI><LI>Should I be using a Connection &amp; Credential Alias instead of directly accessing the credential?</LI><LI>Does anyone have an example of making a REST call from script using a credential whose secret is stored in CyberArk/CCP?</LI></OL><P>Any guidance or best practices would be greatly appreciated.</P></DIV> Thu, 24 Sep 2026 10:21:35 GMT https://www.servicenow.com/community/community-central-forum/accessing-api-key-stored-in-external-vault-cyberark-ccp-from/m-p/3601769#M7944 bandarunave 2026-09-24T10:21:35Z