--- sourceDocument: Australia ServiceNow AI Platform Administration sourceDocumentLink: https://www.servicenow.com/docs/r/platform-administration Release : - australia ft:locale : - en-US ft:publication_title : - Australia ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # OAuth 2.0 authentication for clone targets # OAuth 2.0 authentication for clone targets {#ariaid-title1} Release version: Australia Updated June 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of OAuth 2.0 authentication for clone targets OAuth 2.0 authentication for clone targets modernizes and secures the process of cloning instances in ServiceNow by eliminating the need for local admin accounts on target instances. It allows use of existing login credentials, including Single Sign-On (SSO), enhancing security and simplifying administration. Show full answer Show less ## Key Features * **Elimination of local admin accounts:** No need to maintain separate local admin credentials for cloning; existing user credentials are used. * **One-time target instance registration:** During setup, the target instance generates a Client ID. Administrators copy this to the source instance to register it as an authorized OAuth client. * **OAuth 2.0 Authorization Code Flow:** The source instance acts as the OAuth client, and the target instance as the authorization server. Authentication occurs once during setup or when a session expires. * **Short-lived JWT access tokens:** For each clone request, the source instance automatically obtains a time-limited JSON Web Token (JWT) to authenticate the operation. * **Role requirements:** The source instance user must have the `cloneadmin` role to request clones. The target instance requires the `oauthadmin` role only during initial OAuth setup. * **Basic Authentication fallback:** Basic Auth is supported only if OAuth fails, with strict requirements (user must have `cloneadmin` and `soap` roles and `identitytype` set to `machine`). Users with `identitytype=machine` cannot log in via the UI and this method is intended for automated or integration use only. ## Practical Impact for ServiceNow Customers This OAuth 2.0 authentication approach improves security by avoiding shared or static admin credentials and leverages existing authentication mechanisms like SSO. It reduces administrative overhead by requiring one-time setup per target instance and automatically managing token lifecycle for each clone operation. In cases where tokens expire, users are prompted to reauthorize the connection easily from the Clone Admin Console, ensuring smooth ongoing operation without manual credential management. Basic Auth remains available only as a fallback and requires careful configuration, mainly suited to automated processes rather than human users. OAuth 2.0 authenticates clone requests to target instances without requiring a local admin account, enabling you to use your existing login credentials. ## Why OAuth 2.0 replaces basic authentication {#clone-oauth-authentication__clone-oauth-authentication-why-oauth} Previously, Instance Clone used basic authentication to confirm access to a target instance. This required maintaining a local admin account specifically for cloning and entering those credentials for each clone request.{#clone-oauth-authentication__clone-oauth-authentication-why-oauth-p1} The OAuth 2.0 Authorization Code Flow enhances security and convenience by providing the following benefits:{#clone-oauth-authentication__clone-oauth-authentication-why-oauth-p2} * No local admin account required - use your existing login credentials, including SSO. * One-time target instance registration. * Automatic token generation and expiration for each clone request. ## How it works {#clone-oauth-authentication__clone-oauth-authentication-how-it-works} The source instance acts as the OAuth client, and the target instance acts as the OAuth authorization server. Authentication happens once per target instance during setup and repeats only if the session expires or is revoked.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p1} During setup, the target instance generates a Client ID that uniquely identifies the source instance as an authorized OAuth client. Administrators copy this Client ID and return it to the source instance to complete registration.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p2} After setup is complete, Instance Clone uses a short-lived JSON Web Token (JWT) access token to authenticate each clone request to the target. The source instance obtains this token automatically before each clone operation.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p3} The clone_admin role is required on the source instance to request clones. The oauth_admin role is required on the target instance during initial setup only.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p4} ## Token lifecycle {#clone-oauth-authentication__clone-oauth-authentication-token-lifecycle} The JWT access token has a short time-to-live (TTL) and expires automatically after each use. If a token expires, the system automatically redirects the user to reauthorize on the target instance from the Clone Admin Console before a clone can be requested.{#clone-oauth-authentication__clone-oauth-authentication-token-lifecycle-p1} ## Basic Auth fallback {#clone-oauth-authentication__clone-oauth-authentication-basic-auth-fallback} Basic Auth is available only as a fallback when the OAuth flow fails. Because of recent platform-wide authentication changes, using Basic Auth to authenticate the clone target requires that the target-instance user have:{#clone-oauth-authentication__clone-oauth-authentication-basic-auth-fallback-p1} * the clone_admin role * the soap role * identity_type set to machine on the user record {#clone-oauth-authentication__clone-oauth-authentication-basic-auth-fallback-ul1} Warning: Users with identity_type = machine can no longer log in to the instance UI. This configuration supports Basic Auth for automated and integration traffic only. The identity_type field may not appear on the User form by default. If it isn't visible, add it temporarily using Form Layout. ## One-time setup per target instance {#clone-oauth-authentication__clone-oauth-authentication-setup} OAuth setup is required once per target instance. No re-registration is required for routine clone requests. If a token expires, the system prompts you to select Authorize on the target instance before you can place a clone request.{#clone-oauth-authentication__clone-oauth-authentication-setup-p1} For more information, see [Set up OAuth authentication for a clone target](https://www.servicenow.com/docs/SV0x_YL5BhxcRuiNXJwvzw "Complete a one-time OAuth setup to register a target instance for cloning. This process generates a Client ID on the target instance and authorizes the connection from the source instance.").