---
sourceDocument: Australia Impact
sourceDocumentLink: https://www.servicenow.com/docs/r/impact

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Impact

ft:clusterId :

    - ipact

bundleId :

    - ipact


---

# Configure the OAuth authentication method development instance

# Configure the OAuth authentication method development instance {#ariaid-title1}

* Release version: Australia
* 
* Updated May 28, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Set up OAuth authentication for instance-to-instance Scan Engine integrations using several stages, an integration user account, an OAuth2 configuration record, and provider and client application registries.

## About this task

OAuth requires a minimum of one provider record and two client records per connection direction. The provider is created on the instance that receives connections (typically Production); the client is created on the
initiating instance (typically Development) and must also be present on the provider instance.  
Note:  
ServiceNow platform UI labels the outbound client record as consumer. This documentation uses the term client to align with standard OAuth terminology. The OAuth API endpoint for clients registry type is deprecated, use Connect to a third-party OAuth Provider instead.

## Before you begin

Role required: Scan Engine Admin (sn_se.scan_engine_admin).

## Procedure

Stage 1 --- Confirm the integration user account

1. Confirm that the integration user account exists in both development and production instances, has the required roles assigned, and that the account password is recorded in a secure location for use in later stages.  
   If the account has not been created yet, complete [Create an integration user account](https://www.servicenow.com/docs/R8zhF4x0HSwyhYcCi965FA "Create a dedicated integration user account and assign the required roles so that the Scan Engine can authenticate and communicate between your ServiceNow instances.") before continuing.

Stage 2 --- Create an OAuth2 configuration record in the Development instance

2. Navigate to `sys_auth_profile_oauth2.list` and select New.  
   If the username and password fields are not visible, customize the form to display them.
3. Populate the Name, Application scope (Scan Engine), Username (matching the integration user ID), and Password fields.
4. Submit the record.  
   If this record is imported to another instance, re-enter the password on that instance before use.

Stage 3 --- Configure the provider on the Development instance

5. Set the Application scope to Scan Engine.
6. Navigate to ALLSystem OAuthInbound IntegrationsNew integration.
7. Select O-Auth- Resource Owner Password Credentials Grant.
8. Fill out the form only indicated as follows:  
   {#configure-oauth-auth-method__entry__2}

   | Field | Description |
   |-|-|
   | Name | OAuth-Client-Dev |
   | Provider Name | Leave empty. |
   | Client ID | Copy the client id to a text file for later use. |
   | Client secret | Enter the password used for the integration account for alignment purposes. |
   | Comments | Leave empty. |
   | Active | True |
   | Auth scope | useraccount |
   | Advanced options (optional): Token Format | Opaque |
   [ ]

9. Select Save.  
   The new OAuth Client-Dev account will be listed in the inbound integrations list.

Stage 4 - Create the OAuth Provider application registry

10. Navigate to ALLSystem OAuthApplication RegistryNew.
11. Select Connect to an OAuth Provider (simplified)- Outbound.  
    {#configure-oauth-auth-method__entry__20}

    | Field | Value |
    |-|-|
    | Name | OAuth Provider - Dev |
    | Client ID | Enter or paste the client id from the O-Auth- Resource Owner Password Credentials Grant step. |
    | Client Secret | Enter the same password from the client integration account. |
    | Default Grant Type | Resource Owner Password Credentials |
    | Authorization URL | N/A |
    | Redirect URL | Select the redirect URL Ex: https://dev.servicenow.com/oauth_redirect.do |
    | Token URL | Use the redirect URL with a suffix of "token", Ex: https://dev.servicenow.com/oauth_token.do |
    [ ]

12. Save the record.  
13. For the OAuthAPI Script, select OAuthUtil.
14. Save the record.

Stage 5 - Set up the SN Instances

15. Navigate to AllScan EngineMy SN Instances.  
    If the My SN Instances record for this instance has not been created yet, complete [Register your instance](https://www.servicenow.com/docs/CW_9LTbn1YISzXh4d4sYSg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.") before continuing.
16. Open the existing instance record and configure the OAuth-specific fields as follows.  
    {#configure-oauth-auth-method__entry__36}

    | Field | Value |
    |-|-|
    | Authentication Type | OAuth |
    | OAuth Application Registry | OAuth Provider-Dev |
    | OAuth User Profile | New: Use the same integration account name, username, and password. |
    [ ]

17. Select Submit.

Stage 6 - Validate connection

18. Save the record, then select Validate Connection.  
    Connection Status updates to Connection valid.  
    Note:  
    If the Connection status returns an Error: User not setup on target instance, refer to the Key Management Framework setup step in [Validate your instance connection](https://www.servicenow.com/docs/HA6MFEOw7zePlehyV0xnCQ "Validate the connection between registered instances to confirm that authentication and My SN Instances configuration are correct before enabling integrations.").
* **[Configure the OAuth authentication method production instance](https://www.servicenow.com/docs/U1vbd9zLkRmM8GWrIUPM7g)**   
  Export OAuth records from the development instance, import them into the production instance, correct Key Management Framework (KMF) credential encryption, and configure development-to-production authentication so that both instances can validate their connections to each other.

*[\>]: and then