--- sourceDocument: Brazil Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Set up A2A authentication # Setting up A2A authentication for ServiceNow AI agents {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Configure ServiceNow AI agents as secondary agents over the Agent2Agent (A2A) protocol by setting up authentication and enabling external agent interoperability. ## Before you begin Before you begin, verify the following requirements: * Platform version: Yokohama Patch 11+ (January 2026) or Zurich Patch 4+ (December 2025) * Now Assist AI Agents 6.0.x or later (December 2025 release or newer) * Administrator access to configure system settings and API policies {#set-up-a2a-auth__ul_ivp_pxq_kkc} Role required: sn_aia.admin ## Procedure 1. Enable external agent settings in AI Agent Studio. 1. Go to AllAI Agent StudioSettings. 2. Under External AI agents, set the following properties to Allow: * Allow ServiceNow to access external AI agents * Allow third party access to ServiceNow AI agents {#set-up-a2a-auth__ul_esm_txq_kkc} {#set-up-a2a-auth__substeps_dsm_txq_kkc} 2. Create and configure a service account with appropriate roles. 1. Create a user in the User \[Sys_User\] table with the following settings: * Active: true * Password needs reset: false * Locked out: false {#set-up-a2a-auth__ul_n4n_pyq_kkc} 2. Assign the following roles to the user: * sn_aia.integration (recommended for basic runtime access) * sn_aia.admin (for testing only -- full write/create access) * Any necessary application roles such as itil * Integration roles: rest_service and snc_platform_rest_api_access {#set-up-a2a-auth__ul_o4n_pyq_kkc} {#set-up-a2a-auth__substeps_m4n_pyq_kkc} 3. Select and configure the AI agent for external discovery. 1. Navigate to AllAI Agent StudioAgentic Solutions. 2. Select the AI agent you want to configure. Note the Sys_Id of the AI agent from the browser address bar or directly from the AI Agent \[sn_aia_agent\] table. 3. Enable Allow third-party to access this AI agent. This makes the agent externally discoverable and sets the `External discoverable` property to true in the AI Agent Config record. 4. Select a display channel where your external AI agent can be discovered. Under the Channel and display section of the external AI agent, select one or both the display options: * ServiceNow Otto panel * ServiceNow Otto chat assistants {#set-up-a2a-auth__ul_v1p_k2r_kkc} {#set-up-a2a-auth__substeps_opy_z1r_kkc} 4. Configure the communication mode. 1. Decide on your communication mode: * **Synchronous:** Use for testing with Postman or when you don't have a functional callback URL. * **Asynchronous:** Recommended for production for better user experience and performance. Requires a callback URL configured in the External Agent Callback Registry table. {#set-up-a2a-auth__ul_h41_p2r_kkc} 2. To set synchronous mode, go to AI Agent StudioSettingsExternal AI agentsDiscoverability and set the Communication mode to Synchronous. Alternatively, navigate to AllTablesMessaging ChannelsAI Agent A2A Channel and set Synchronous to true. {#set-up-a2a-auth__substeps_g41_p2r_kkc} 5. Create an OAuth application registry for external clients. 1. Go to System OAuthApplication Registry. 2. Select New and choose Create an OAuth API endpoint for external clients. 3. Fill in the following fields: * Name: Enter a descriptive name (example: A2A OAuth External Agents) * Client ID: Auto-populated * Client Secret: Auto-generated upon saving {#set-up-a2a-auth__ul_or2_hjr_kkc} 4. Under Auth Scopes, add the `a2aauthscope` record. 5. Save the Application Registry record. {#set-up-a2a-auth__substeps_nr2_hjr_kkc} 6. Configure authentication profiles for OAuth or API key access 1. Choose your authentication method: OAuth 2.0 or API Key. * To configure OAuth 2.0: * Navigate to System Web ServicesAPI Access PoliciesInbound Authentication Profile and select New. * Set Type to OAuth and select the OAuth entity you created in the previous step. {#set-up-a2a-auth__ul_fc3_glr_kkc} * To configure API Key: * Navigate to System Web ServicesAPI Access PoliciesInbound Authentication Profiles, select New. * Select Create API Key authentication profiles and set Auth Parameter to `x-sn-apikey`. {#set-up-a2a-auth__ul_jdm_cmr_kkc} {#set-up-a2a-auth__ul_k5m_1mr_kkc} 2. For API Key authentication, go to System Web ServicesAPI Access PoliciesREST API Key, select New, and configure: * User: Select your service account * Auth Scope: a2authscope {#set-up-a2a-auth__ul_zbp_1lr_kkc} {#set-up-a2a-auth__substeps_ybp_1lr_kkc} 7. Add authentication profiles to the API access policy. 1. Navigate to System Web ServicesAPI Access PoliciesREST API Access Policies. 2. Select AI Agent A2A API Access Policy. 3. Under Inbound authentication profiles, add your authentication profile (OAuth or API Key) to the list. {#set-up-a2a-auth__substeps_g4w_mmr_kkc} 8. Test the A2A API configuration using your chosen authentication method. 1. API Key authentication: Open Postman and create a GET request: * Method: GET * URL: `https://.service-now.com/api/sn_aia/a2a/id//well_known/agent_json` * Headers: Add `x-sn-apikey: ` {#set-up-a2a-auth__ul_vwq_pmr_kkc} 2. OAuth 2.0 authentication: In Postman, set Auth Type to OAuth 2.0, configure grant type and credentials, then select Get New Access Token. 3. Send the request and verify a 200 OK response with the Agent Card payload returned for your AI Agent sys_id. {#set-up-a2a-auth__substeps_uwq_pmr_kkc} 9. Configure external instance connectivity (for multi-instance setups). 1. For API Key authentication on client instance, navigate to IntegrationHubConnections \& Credential Aliases. Create two connection aliases: one for Agent Card discovery and one for Agent Execution. For each, set the connection URL to the appropriate A2A endpoint on the server instance and configure a credential with header `x-sn-apikey`. 2. For OAuth 2.0 authentication on client instance, create an outbound Application Registry in System OAuthApplication Registry using the same Client ID and Client Secret from the server instance. Create the appropriate connection aliases and OAuth 2.0 credentials in IntegrationHub. 3. In AI Agent Studio on the client instance, navigate to Create and manageAI agents and select AddExternal. Choose Agent2Agent (A2A) Protocol and select your connection alias as the external provider. {#set-up-a2a-auth__substeps_l45_pnr_kkc} 10. Debug and validate your A2A implementation. 1. Enable debug system properties to review logs during troubleshooting: * com.snc.platform.security.oauth.debug: true * glide.auth.debug.enabled: true 2. Navigate to Flow DesignerFlow AdministrationSettings. Set Reporting to Trace and Logging to Debug for sub-production environments only. 3. Review the following tables to validate execution and connectivity: * Execution Plan \[`sn_aia_execution_plan`\] * External Agent Execution History \[`sn_aia_external_agent_exec_history`\] 4. Verify that service account credentials are in good standing: Active status, password does not need reset, and account is not locked out. ## Result You have successfully configured ServiceNow AI agents as secondary agents over the A2A protocol. Your AI agents can now accept external requests from other systems using either OAuth 2.0 or API key authentication. ## What to do next After completing this setup, you can: * Add your configured AI agents as external agents in other ServiceNow instances. * Integrate your AI agents with third-party systems using the A2A protocol. * Monitor agent execution and troubleshoot connectivity issues using the execution history tables. *[\>]: and then