---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# OAuth Inbound

# OAuth Inbound {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Inbound authentication allows trusted external applications to securely access ServiceNow APIs, ensuring controlled and authorized connections.

You must have the <kbd class="ph userinput">security_admin</kbd> role to manage the OAuth integration.

You can configure OAuth external client scenario (Inbound) integration, when your want your instance to provide an endpoint for third-party clients to pull data from the instance.  
Note:  
You must user authenticate for the first time to fetch the token post which, you don't need to authenticate using a user account before the token expiry.

You can perform the OAuth inbound configuration, depending on the following type of grant type:

* Authorization code grant flow: For a user initiated grant flow, where the user without requiring to enter username or password, but through the access token can configure an authorized URL for authentication. For more information, see [OAuth authorization code grant flow](https://www.servicenow.com/docs/lfmZz4zAcTv1StMgVFa13g "Authorization code grant flow allows a user to access a resource by authenticating directly with an OAuth server that trusts the resource, in contrast with authenticating with username/password credentials.").
* Password grant flow: For a user initiated grant flow, where a user interaction is required for authentication. For more information, see [Password grant](https://www.servicenow.com/docs/D9ifUj_y6PCV7ATLL_j_hQ "End users who own a protected resource on the ServiceNow instance must authorize access to the resource before the instance can provide the access token.") flow configuration.  
  Note:  
  For authorization code flow, user needs to complete the Authentication by local login, SSO or MFA and then provide consent.
* JWT bearer grant flow: For a system to system integration, where a user intervention is not required. For more information, see [JWT bearer grant flow](https://www.servicenow.com/docs/UzLIVZPh2GGl3S4y3eG1kg "OAuth JWT bearer token enables the client web applications to authenticate with your instance seamlessly using the inbound JWT grant type instead of requiring the end user to manually log in or share the password.") configuration.
* ID token flow: For using a ID token issued by 3rd party OIDC providers such as Okta, Azure. For more information, see [ID token flow](https://www.servicenow.com/docs/rhWJOO8J6bIwbql4QQ1nlg "Configure an OAuth OpenID Connect (OIDC) provider to accept identity tokens generated by a third-party OIDC provider using inbound API calls using Single Sign-On option (Multi-Provider SSO).") for authentication.
* OAuth implicit grants: For allowing the access token to be given directly to the client application through the user agent, which is typically the web browser or mobile device. For more information, see [OAuth implicit grants](https://www.servicenow.com/docs/ZjjzV~lGul7ikRy~yGtJ4A "ServiceNow instances support the implicit grant of an access token.").
* Client credentials: For using the OAuth client credentials grant type for Inbound Integrations from a third party OAuth client to the ServiceNow® platform. For more information, see [Client Credentials](https://www.servicenow.com/docs/7TTrc45kEsolCfJnYh5~Tg "Use the OAuth client credentials grant type for Inbound Integrations from a third party OAuth client to the ServiceNow platform.").

{#oauth-inbound__ul_hrc_qtt_4wb}

## OAuth Scopes {#oauth-inbound__section_cy4_xyq_cxb}

You can scope the OAuth authentication scope support for REST API. OAuth Scope provides access to only the particular REST APIs. For more information, see [REST API Auth Scope](https://www.servicenow.com/docs/8Z9~3AB5~DnGqSuMWaOhgw "Use the REST API Auth Scope to provide access to a specific REST API").