OAuth 2.0 for Qualys Integration for Security Operations

[lyubenkonov]

Hello Forum,

We're migrating the Qualys Vulnerability Integration (Qualys Integration for Security Operations) from Basic Auth to OAuth 2.0 on ServiceNow Zurich.

Qualys's token endpoint (/auth/oidc) seems to require the credentials as two custom HTTP headers named exactly clientId and clientSecret, and returns the raw JWT as a plain string rather than a JSON object with an access_token field... I confirmed this by calling the same endpoint manually with curl, passing the credentials as headers, which returns a valid JWT: curl.exe -X POST "https://<gateway>/auth/oidc" -H "clientId: <id>" -H "clientSecret: <secret>"

ServiceNow's stock OAuth handler doesn't seem to be able to produce either, and the call fails with a 401.

Has anyone successfully configured this integration to use OAuth 2.0?

If so, how did you approach it?

Any tips/tricks are appreciated!

[Tanushree Maiti]

Hi @lyubenkonov 

Can you validate your command once.

Refer:

https://www.servicenow.com/community/developer-forum/am-i-able-to-use-curl-command-on-a-developer-in...

Also check :

KB1275215 How to configure JWT authentication for inbound API calls 

[lyubenkonov]

Hello Maiti,

Thanks for the provided documents, but they are revolving around inbound direction of traffic:
- KB1275215 is about inbound calls: configuring ServiceNow as a token provider so external clients can call into your instance using JWT. 
- And the curl thread is about Basic-auth'ing into ServiceNow's own REST API (base64 username:password). Also inbound, and about ServiceNow being the target, not the caller.

To clarify - I am asking about an outbound integration (ServiceNow → Qualys), not inbound. The curl works on its own, but the issue is that ServiceNow's built-in OAuth client can't send credentials as custom headers (clientId/clientSecret) on the outbound token request - it only sends Authorization: Basic or body params.

[william_tran]

Hi Lyubenkonov,

Feel free to reachout to me directly at william.tran@servicenow.com.

I'm currently working through this right now, and happy to help out where I can.

[lyubenkonov · Accepted solution]

UPDATE:

After a fairly long investigation, it turned out that OAuth 2.0 is not actually implemented in any of the out-of-the-box Qualys integration scripts (as of July 2026). The official ServiceNow documentation states that OAuth is available for the Qualys integration, but in practice selecting "oauth" applies no authentication - the shipped integration scripts only handle Basic. We raised a ServiceNow Developer Support case, which confirmed this and helped shape a supported, upgrade-safe approach.

The solution we built:

• A dedicated custom scope, so upgrades to the vendor Qualys plugin never overwrite the customization.

• OAuth-enabled integration scripts in that scope, based on the vendor scripts but with an OAuth branch added.

• A custom table in the scope holding client_id, client_secret, and the cached token (secret and token in encrypted Password2 fields).

• An addition Script Include in the scope that decrypts the credential, builds the specific token request Qualys expects and caches the token for its validity window.

Each integration record is then simply pointed at its OAuth-enabled script.

Happy to share more detail if it's useful to anyone - feel free to reply here or via LinkedIn - https://www.linkedin.com/in/lyuben-konov-a8a621196/