---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# OAuth 2.0 credentials

# OAuth 2.0 credentials {#ariaid-title1}

Release version: Yokohama  
Updated October 8, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of OAuth 2.0 credentials

OAuth 2.0 credentials in ServiceNow enable secure access to user accounts on HTTP services by obtaining OAuth tokens.
These credentials are configured through a dedicated form where key details about the authentication and integration setup are specified.
This capability is essential for integrating ServiceNow with third-party OAuth providers and managing access tokens effectively.
Show full answer Show less  

## Key Features

* **Name:** Assign a unique, descriptive identifier to each OAuth credential for easy management.
* **Active:** Toggle to enable or disable the credential as needed.
* **OAuth Entity Profile:** Combines a grant type (such as Client Credentials, Authorization Code, or Resource Owner Password Credentials) with at least one scope to define the authorization context.
* **Connect to Auth Server via MID Server:** Option to route OAuth token requests through a MID Server, enabling secure connection to on-premise or cloud-based OAuth servers behind firewalls. This is available only for certain grant types and requires proper MID Server configuration and permissions (oauthadmin role).
* **Applies to:** Specify whether the credential applies to all MID Servers or selected ones, ensuring that chosen MID Servers can communicate with the OAuth provider.
* **Order:** Defines the priority sequence in which Discovery or other processes attempt to use credentials, important for managing login attempts and avoiding lockouts.
* **Credential Alias:** Link the OAuth 2.0 credential to a credential alias for referencing within integrations.
* **Integration Type:** Defines whether the token generated is system-specific or user-specific, which affects the scope of accessible information. System type supports SAML and JWT authentication, while Personal type supports user-specific tokens and requires the oauthadmin role on the MID Server user.

## Practical Considerations for ServiceNow Customers

* Ensure MID Servers selected for OAuth token requests are properly configured, active (Status = Up), validated, and have the REST or ALL capability.
* When using Personal integration type, user-specific OAuth tokens can access user-related information securely. In workflows, select "Run As" user who initiates session to use such tokens.
* Credential order management is critical when multiple credentials exist, preventing security issues such as lockouts from repeated failed attempts.
* Follow prescribed role assignments (oauthadmin) for users configuring OAuth integrations to maintain security and proper access control.  
OAuth 2.0 credentials enable ServiceNow to obtain access to user accounts on an HTTP
service.
These fields are available in the Credentials form for OAuth 2.0.{#oauth-2-credentials__table_ezk_y3d_hbb__entry__2}

| Field | Input value |
|-|-|
| Name | Enter a unique and descriptive name for this credential. For example, you might call it OAuth2 credential. |
| Active | Specify whether this credential is active. |
| OAuth Entity Profile | An OAuth profile is a combination of a grant type and at least one scope. |
| Connect to Auth Server via MID Server | Connects your ServiceNow instance to an on-premise OAuth server that resides behind a firewall through a MID Server. It can also connect your ServiceNow instance to a cloud-based OAuth server through a MID server. When this option is enabled, the request for an OAuth token is sent through the MID Server. Important: * The option appears when the value in the Grant type field in the OAuth Entity Profile is set to eitherClient Credentials, Authorization Code, or Resource Owner Password Credentials. To learn how to set an OAuth entity profile for a third-party OAuth provider, see [Connect to a third-party OAuth provider](https://www.servicenow.com/docs/uOPcJWUBGskjbpp7njsT2g "Configure how the client ID and secret are sent to your OAuth provider."). * If you select the Connect to Auth Server via MID Server checkbox, you must identify the required MID Server or MID Servers from the Applies to list. * MID Server user needs the <kbd class="ph userinput">oauth_admin</kbd> role to Set up OAuth integration via MID Server. {#oauth-2-credentials__ul_a3s_gvc_lzb} |
| Applies to | Specify if the credential record is applicable for all MID Servers, or a specific MID Server. If specific, add the MID servers as necessary. Important: Ensure that you are aware of these considerations if you have selected the Connect to Auth Server via MID Server check box. * Ensure that all the MID Servers selected in Applies to can communicate with the Auth server. This is required to execute the token request against the Token URL mentioned in the OAuth provider record (that is linked to the OAuth entity profile specified in the OAuth 2.0 credential record). * Ensure that there is at least one MID Server (in the MID Servers selected in Applies to) with these configurations: * The value of the Status field is Up. * The value of the Validated field is Yes. * The capability of the MID Server is set to REST or ALL. To learn how to configure the MID server, see [https://www.servicenow.com/docs/access?context=configure-capabilities\&version=yokohama\&pubname=yokohama-integrate-applications\&ft:locale=en-US](https://www.servicenow.com/docs/access?context=configure-capabilities&version=yokohama&pubname=yokohama-integrate-applications&ft:locale=en-US). To learn more about these statuses, see [MID Server dashboard](https://www.servicenow.com/docs/access?context=c_MIDServerDashboard&version=yokohama&pubname=yokohama-servicenow-platform&ft:locale=en-US). {#oauth-2-credentials__ul_jpk_3t5_c1c} {#oauth-2-credentials__ul_q2t_ht5_c1c} |
| Order | Order (sequence) in which Discovery tries this credential as it attempts to log on to devices. The smaller the number, the higher in the list this credential appears. Establish credential order when using large numbers of credentials or when security locks out users after three failed login attempts. If all the credentials have the same order number (or none), the instance tries the credentials in a random order. |
| Credential alias | Specify the credential alias that you want to tie to the OAuth 2.0 credential. |
| Integration Type | Indicates the integration type for the credential. Invoke an API of a third-party with an OAuth request that generates an OAuth token that is system or user specific. Following are the integration types: * System: Pull the token information based on the requester profile. The System integration type supports the following authentication mechanisms: 1. Security Assertion Markup Language (SAML) 2. JSON Web Token (JWT) {#oauth-2-credentials__ol_y5d_g4k_3fc} * Personal: Pull the token information that is user-specific. The MID Server user must have the `oauth_admin` role. The Personal and System integration types support the following grant types: 1. Authorization Code 2. Resource Owner Password Credentials {#oauth-2-credentials__ol_p3v_b4k_3fc} {#oauth-2-credentials__ul_hkw_xgj_ltb} If this Personal is selected on the OAuth Requestor Profile page, an additional flag called as Personal is displayed. Note: * Any information that is related to a user can only be accessed with user-specific OAuth tokens with the Integration Type as Personal. * To use the session user-related token, you have to select the Run As filed in the Flow properties as User who initiates session. {#oauth-2-credentials__ul_mxp_k3j_ltb} |
[Table 1. OAuth 2.0 credentials form]

{#oauth-2-credentials__table_ezk_y3d_hbb}