Now SDK & CLI - sn_appauthor.all_company_keys issue resolution

[Cuneyt Bozok]

I initialized a new app using @Servicenow/sdk init, did some development, installed it to my PDI, and then tried to pull changes back down using now-sdk transform. Every download attempt failed with:

[now-sdk] ERROR: Application download failed: Not allowed to download application x_maf_core. Check that you either have maint access or have added your company key (e.g. sn for ServiceNow) to the sn_appauthor.all_company_keys system property.

I'm an admin on the PDI, but maint is not a role you can grant yourself — so the only viable path was the company key route.

Diagnosis

The error message is returned by the instance's download API (not by a local config file). The API extracts the prefix from the app's scope (x_<prefix>_<name>) and checks whether that prefix exists in the system property sn_appauthor.all_company_keys.

In my case:

• App scope: x_maf_core → prefix the API was looking for: maf
• sn_appauthor.all_company_keys on my PDI: 1861091 (the numeric company code)
• glide.appcreator.company.code: 1861091
• The sys_app record had empty vendor, vendor_prefix, and sys_code fields

The SDK had created the app under the prefix maf, but the instance only "owned" the prefix 1861091. Mismatch → download rejected.

What didn't work

A few things I tried first that did not fix it:

• Running the KB0992734 script (clears sn_appclient / sn_appauthor upload base URLs and queues a config refresh). Useful for cleaning junk values in the company-code properties, but doesn't add a new key.
• Editing vendor on sys_app. The download API doesn't consult that field for the ownership check.
• Trying npm install @Servicenow/sdk@next (4.6.0). Failed with ETARGET because @Servicenow/isomorphic-rollup@1.3.1 isn't on the public npm registry yet.
•  

What worked

Two background scripts and a cache flush. Run as admin in System Definition > Scripts - Background with scope set to Global.

Step 1 — Align the sys_app fields and add the company key

javascript

(function () {
    var APP_SYS_ID  = 'YOUR_SYS_APP_SYS_ID';
    var COMPANY_KEY = 'maf';                            // matches x_<key>_ in your scope
    var VENDOR_NAME = 'Your App Display Name';
    var PROP_NAME   = 'sn_appauthor.all_company_keys';

    // Update sys_app
    var app = new GlideRecord('sys_app');
    if (!app.get(APP_SYS_ID)) {
        gs.print('ERROR: sys_app ' + APP_SYS_ID + ' not found.');
        return;
    }
    app.setValue('vendor', VENDOR_NAME);
    app.setValue('vendor_prefix', COMPANY_KEY);
    app.setValue('sys_code', COMPANY_KEY);
    app.update();

    // Add COMPANY_KEY to sn_appauthor.all_company_keys
    var prop = new GlideRecord('sys_properties');
    if (!prop.get('name', PROP_NAME)) {
        gs.print('ERROR: Property ' + PROP_NAME + ' not found.');
        return;
    }

    var current = (prop.getValue('value') || '').trim();
    var keys = current ? current.split(',').map(function (k) { return k.trim(); }).filter(String) : [];

    if (keys.indexOf(COMPANY_KEY) === -1) {
        keys.push(COMPANY_KEY);
        prop.setValue('value', keys.join(','));
        prop.update();
    }

    // Trigger refresh + flush cache
    gs.setProperty('sn_appauthor.check.config.update', 'true');
    try { GlideProperties.refresh(true); } catch (e) {}
    gs.print('Done. ' + PROP_NAME + ' = "' + gs.getProperty(PROP_NAME) + '"');
})();

After this, my property looked like 1861091,maf and the download check passed.

Step 2 — Bonus: dealing with the next error you'll probably hit if you have a workspace

After the download finally worked, the transform threw a follow-up validation error:

error TS11: View name can only contain alphanumeric charactersname: 'workspace-6fc21ed6cd3c496194fa8afdb8836da1'

Workspace Builder generates sys_ui_view records with hyphenated names like workspace-<sys_id>, but the SDK's Fluent View API rejects anything non-alphanumeric. Fix:

javascript

(function () {
    var SYS_ID = 'YOUR_VIEW_SYS_ID'; // from the SDK error message

    var v = new GlideRecord('sys_ui_view');
    if (!v.get(SYS_ID)) {
        gs.info('Record not found.');
        return;
    }

    var oldName = v.getValue('name');
    var newName = oldName.replace(/[^A-Za-z0-9]/g, '');
    v.setValue('name', newName);
    v.update();
    gs.info('Renamed "' + oldName + '" -> "' + newName + '"');
})();

If the workspace is one you actively use, prefer excluding the record via now.config.json instead of renaming it (the rename can break the workspace's link to the view).

Step 3 — Clear local SDK caches before retrying

If your transform still shows the old data after instance changes, the SDK is reading from a cached download package. Wipe these and retry:

bash

rm -rf /var/folders/**/servicenow/downloadrm -rf /var/folders/**/.nowrm -rf src/fluent/generatednpx @servicenow/sdk transform --auth admin -d

(macOS paths shown — Linux/Windows users adjust the temp dir accordingly.)

Summary

If you hit the "Not allowed to download application" error on a PDI:

1. Identify your scope's prefix (the <key> in x_<key>_<name>).
2. Add it to sn_appauthor.all_company_keys (comma-separated).
3. Backfill vendor, vendor_prefix, and sys_code on sys_app to match.
4. Flush the property cache.
5. Be ready for downstream transform validation errors on auto-generated UX records.

You don't need maint for any of this. Hope this saves someone the day I lost figuring it out.

---

Environment

• ServiceNow PDI (Australia / PDI instance)
• @Servicenow/sdk 4.5.0
• macOS (script paths above)