---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restricted Binding functionality in case Bearer Authorization \[New in Security Center 7.0\]

# Restricted Binding functionality in case Bearer Authorization \[New in Security Center 7.0\] {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Use a system property and restricted binding to ensure that an access token generated using that entity can't be used for UI calls.
Use the glide.oauth.enforce_restricted_binding_for_ui system property and enable restricted binding for an OAuth entity to prevent the access tokens generated by that entity from being used for UI calls (For
example, <kbd class="ph userinput">incident_list.do</kbd>).

When restricted binding is turned off, the access token generated can be used for UI calls regardless of the value of the system property.

Ensure that glide.oauth.enforce_restricted_binding_for_ui is set to true and Enforce Token Restrictions is set to true in all OAuth entity
entries. For details on OAuth entity entries, see [OAuth inbound](https://www.servicenow.com/docs/~rBzU358mr9UjwtRF3cKHw "OAuth Inbound authentication allows trusted external applications to securely access ServiceNow APIs, ensuring controlled and authorized connections.").

## More information {#sc-restricted-binding-functionality-in-case-bearer-authorization__section_qhx_1b1_xwb}

{#sc-restricted-binding-functionality-in-case-bearer-authorization__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.oauth.enforce_restricted_binding_for_ui |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Category | [Architecture, design, and threat modeling](https://www.servicenow.com/docs/eGRaRfzWgfV~Ij_lxvlawg "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Severity score: 5.0 * CVSS score: Medium * Security risk details: When the glide.oauth.enforce_restricted_binding_for_ui system property isn't set to true or restricted binding is turned off, then a user with the access token to access an API (for example, mobile API) can get a session issued and use it to access other restricted resources on the instance (for example, <kbd class="ph userinput">incident_list.do</kbd>). {#sc-restricted-binding-functionality-in-case-bearer-authorization__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-restricted-binding-functionality-in-case-bearer-authorization__table_ajc_b43_3kb}