---
sourceDocument: Brazil Impact
sourceDocumentLink: https://www.servicenow.com/docs/r/impact

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Impact

ft:clusterId :

    - ipact

bundleId :

    - ipact


---

# Configure the OAuth authentication method production instance

# Configure the OAuth authentication method production instance {#ariaid-title1}

Release version: Brazil  
Updated October 27, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read  
Export OAuth records from the development instance, import them into the production instance, and correct Key Management Framework (KMF) credential encryption. Configure development-to-production authentication so that both
instances can validate their connections to each other.

## About this task

After the development instance is validated, see [Configure the OAuth authentication method development instance](https://www.servicenow.com/docs/JMYCW35QMol3B5RjYlAheQ "Set up OAuth authentication for instance-to-instance Scan Engine integrations using several stages, an integration user account, an OAuth2 configuration record, and provider and client application registries."), the production instance must be able to communicate with development, and development must be able to communicate with production. This requires two rounds of record export and
import; one in each direction with KMF credential correction performed after each import.  
Important:  
When OAuth records are imported into a new instance, KMF re-encrypts password fields using the receiving instance's cryptographic key. The stored values appear jumbled and must be manually overwritten with the correct password before the connection can be validated.

## Before you begin

* Complete [Configure the OAuth authentication method development instance](https://www.servicenow.com/docs/JMYCW35QMol3B5RjYlAheQ "Set up OAuth authentication for instance-to-instance Scan Engine integrations using several stages, an integration user account, an OAuth2 configuration record, and provider and client application registries.") on the development instance and confirm that the development connection validates successfully.
* The integration user account must already exist on the production instance with the `sn_se.scan_engine_admin` and `sn_se.internal_rest_integration` roles assigned. See [Create an integration user account](https://www.servicenow.com/docs/L7u6ANwPaPvCvoYiwpoeyg "Create a dedicated integration user account and assign the required roles so that the Scan Engine can authenticate and communicate between your ServiceNow instances.").
* Have the integration account password available in a text editor. You will paste it multiple times during this procedure.
* Role required: Scan Engine Admin (`sn_se.scan_engine_admin`).

## Procedure

Stage 1: Export OAuth records from the development instance

1. On the development instance, navigate to AllScan EngineMy SN Instances and open the development instance record.
2. Select and hold (or right-click) the form header of the My SN Instances record and select Export \> XML.
3. Save the file to a local folder (for example, SE_Data).
4. From the My SN Instances record, drill into the OAuth User Profile field, open the linked record, and export it as XML.
5. Navigate to AllSystem OAuthApplication Registry and filter the list to show only records scoped to Scan Engine.  
   Two records should be present: <kbd class="ph userinput">OAuth Client Dev</kbd> and <kbd class="ph userinput">OAuth Provider Dev</kbd>.
6. Select both records and export them together as XML.
7. Open the OAuth Provider Dev record and locate the auto-generated OAuth entity profile record linked at the bottom of the form.  
8. Open the OAuth entity profile record and export it as XML.  
   You should now have four XML files in your export folder:
   * MySN instance record
   * OAuth user profile
   * Two application registry records (OAuth Client Dev and OAuth Provider Dev)
   * OAuth entity profile record
   {#configure-oauth-auth-method-prod__ul_nty_vjm_kjc}

Stage 2: Prepare Key Management Framework access on the production instance

9. Grant KMF access to your setup user on the production instance, using [Grant Key Management Framework access on an instance](https://www.servicenow.com/docs/XWpnleOsoKncEGm_C4OnwA "Give the setup user KMF roles and approve the Scan Engine decryption policy so that imported credentials can be decrypted on the instance."). Complete the steps in that task before you continue.

Stage 3: Import development records into the production instance

10. On the production instance, navigate to AllScan EngineMy SN Instances.
11. Import the four XML files in the following order, using Import XML for each file:  
    1. OAuth entity profile record
    2. Second OAuth entity profile record (if present)
    3. MySN instance record
    4. OAuth user profile (OAuth2 configuration) record

Stage 4: Correct KMF-encrypted credentials on the production instance

12. Navigate to `sys_auth_profile_oauth2.list` and open the Integration Account OAuth user profile record.
13. Switch the application scope to Scan Engine.
14. If the Username and Password fields are not visible, configure the form to display them, or open the record using the list layout.  
    When prompted whether to edit in Scan Engine or Global scope, select Global for the form configuration only.
15. Overwrite the Password field with the integration account password from your text editor and select Save.  
    Importing the record causes KMF to re-encrypt the password field with the production instance key. Overwriting it restores the correct value.
16. Navigate to AllSystem OAuthApplication Registry and open OAuth Client Dev.
17. Unlock the Client Secret field, overwrite it with the integration account password, and select Save.
18. Return to the Application Registry list and open OAuth Provider Dev.
19. Unlock the Client Secret field, overwrite it with the integration account password, and select Save.

Stage 5: Grant KMF module access and validate the development connection

20. Complete the KMF module access policy steps in [Grant Key Management Framework access on an instance](https://www.servicenow.com/docs/XWpnleOsoKncEGm_C4OnwA "Give the setup user KMF roles and approve the Scan Engine decryption policy so that imported credentials can be decrypted on the instance."), including the step that sets the Scan Engine script include to Track.
21. Navigate to AllScan EngineMy SN Instances, remove any active filters, and open the development instance record.
22. Select Validate Connection.  
    Connection Status updates to Connection Valid. The production instance can now communicate with the development instance. See [Validate your instance connection](https://www.servicenow.com/docs/D7DhNjyDy2a0UaVjDi5Uqg "Validate the connection between registered instances to confirm that authentication and My SN Instances configuration are correct before enabling integrations.") for additional information.

Stage 6: Create the OAuth client and provider for the production instance

23. Confirm the application scope is set to Scan Engine.
24. Navigate to AllScan EngineMy SN Instances and confirm that a My SN Instances record exists for the production instance.  
    If the production instance record has not been created yet, complete [Register your instance](https://www.servicenow.com/docs/qVtcMVX4ueNM5WLtwJLobg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.") before continuing as follows. The record must exist before OAuth fields can be configured.{#configure-oauth-auth-method-prod__entry__2}

    | Field | Value |
    |-|-|
    | Instance Name | The instance name as it appears in `stats.do` for the production instance. |
    | Instance URL | The full URL of the production instance. Select the lock icon next to the field to enter the URL. |
    | Environment | Production |
    [ ]

25. Navigate to AllSystem OAuthInbound Integrations and select New Integration.
26. Select Resource Owner Password Credential Grant and complete the fields in the following table.  
    {#configure-oauth-auth-method-prod__entry__10}

    | Field | Value |
    |-|-|
    | Name | OAuth Client Prod |
    | Provider Name | Leave empty. |
    | Client ID | Copy the auto-generated value to your text editor for use in the next step. |
    | Client Secret | Enter the integration account password. |
    | Auth Scope | useraccount |
    | Advanced options: Token Format | Opaque |
    [ ]

27. Select Save.
28. Navigate to AllSystem OAuthApplication Registry and select New.
29. Select Connect to an OAuth Provider (simplified) --- Outbound and complete the fields in the following table.  
    {#configure-oauth-auth-method-prod__entry__24}

    | Field | Value |
    |-|-|
    | Name | OAuth Provider Prod |
    | Client ID | Paste the client ID copied from OAuth Client Prod. |
    | Client Secret | Enter the integration account password. |
    | Default Grant Type | Resource Owner Password Credentials |
    | Redirect URL | Select the redirect URL for the production instance. Example: https://instancename.service-now.com/oauth_redirect.do |
    | Token URL | Use the redirect URL with the path changed to `oauth_token.do`. Example: https://instancename.service-now.com/oauth_token.do |
    [ ]

30. Select Save.  
    An OAuth entity profile record is automatically generated and appears at the bottom of the form. Leave this record as-is.

Stage 7: Link OAuth records to the production MySN instance and validate

31. Navigate to AllScan EngineMy SN Instances and open the production instance record created in [Register your instance](https://www.servicenow.com/docs/qVtcMVX4ueNM5WLtwJLobg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.").
32. Complete the fields in the following table.  
    {#configure-oauth-auth-method-prod__entry__38}

    | Field | Value |
    |-|-|
    | Authentication Type | OAuth |
    | OAuth Application Registry | OAuth Provider Prod |
    | OAuth User Profile | Select the existing Integration Account profile (the same profile used for the development connection). |
    [ ]

33. Select Save, then select Validate Connection.  
    Note:  
    Because the KMF module access policy for the `ScanEngineApiUtil` script include was already set to Track in Stage 5, the connection should validate immediately without additional KMF steps. See [Validate your instance connection](https://www.servicenow.com/docs/D7DhNjyDy2a0UaVjDi5Uqg "Validate the connection between registered instances to confirm that authentication and My SN Instances configuration are correct before enabling integrations.") for additional information.  
    Connection Status updates to Connection Valid.

Stage 8: Export production records and import into the development instance

34. From the production instance, navigate to AllSystem OAuthApplication Registry and export the following records as XML:  
    * OAuth Client Prod
    * OAuth Provider Prod
    * The OAuth entity profile auto-generated by OAuth Provider Prod
35. Export the production My SN Instances record as XML.
36. Log in to the development instance and navigate to AllScan EngineMy SN Instances.
37. Import the four XML files using Import XML.
38. Navigate to AllSystem OAuthApplication Registry and correct the KMF-encrypted client secret on both OAuth Client Prod and OAuth Provider Prod by overwriting each with the integration account password.  
    See Stage 4 for the correction procedure.
39. Navigate to AllScan EngineMy SN Instances, remove any active filters, and open the production instance record.
40. Select Validate Connection.  
    Connection Status updates to Connection Valid. Both instances now have valid My SN Instances records for development and production.

## Result

Both the development and production instances have validated My SN Instances records in each direction. Definition synchronization, update set summary synchronization, and exception reason synchronization are now
available.

## What to do next

* [Definitions integration](https://www.servicenow.com/docs/4nZ_yboriqpn0168nqeKnA "The Definitions integration manually syncs new, customized, and overridden definitions from development to production and the other instances.")
* [Exception reason integration](https://www.servicenow.com/docs/EFG6Ypsvg2voyT~Lb9VZUA "You can synchronize exception reasons from non-production to Production instances after a record is created or updated.")
* [User story integration](https://www.servicenow.com/docs/QBCS3RB3C09UVcigbHwG0A "The User story integration creates agile tasks and stories directly from Scan Engine finding records in ServiceNow, Jira, Azure DevOps, or any external system.")
* [Deployment and synchronization integrations](https://www.servicenow.com/docs/QiWji3GVGe9K5OapqePfKg "The AES/AEMC and Update set integrations control how custom app deployments are governed and how scan results are synchronized across your instance stack.")
{#configure-oauth-auth-method-prod__ul_zc3_szf_kjc}

*[\>]: and then