--- sourceDocument: Brazil ServiceNow AI Platform Administration sourceDocumentLink: https://www.servicenow.com/docs/r/platform-administration Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # OAuth 2.0 authentication for clone targets # OAuth 2.0 authentication for clone targets {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of OAuth 2.0 authentication for clone targets OAuth 2.0 authentication for clone targets in ServiceNow replaces the previous basic authentication method, enhancing security and simplifying the cloning process. It allows ServiceNow customers to authenticate clone requests to target instances without needing a local admin account, leveraging existing login credentials including Single Sign-On (SSO). Show full answer Show less ## Key Features * **Elimination of local admin accounts:** Clone requests no longer require maintaining or entering separate admin credentials for each target instance. * **One-time target instance registration:** Each target instance generates a unique Client ID to authorize the source instance as an OAuth client, set up only once per target. * **Automatic and secure token handling:** A short-lived JSON Web Token (JWT) access token is automatically generated and used for each clone request, expiring after use to enhance security. * **Role requirements:** The source instance requires the *cloneadmin* role to request clones, and the target instance requires the *oauthadmin* role only during initial OAuth setup. * **Fallback to Basic Authentication:** Basic Auth is available only if the OAuth flow fails, but with stricter requirements including specific roles and the *identitytype* set to *machine* on the user record, supporting automated or integration scenarios only. ## How It Works The source instance acts as the OAuth client, and the target instance acts as the OAuth authorization server. During setup, administrators register the source instance with the target by exchanging the Client ID. After setup, the source instance automatically obtains a JWT access token prior to each clone operation, authenticating the request securely. ## Token Lifecycle and Usage The JWT access token is short-lived and expires after each use. If the token expires, users are prompted to reauthorize on the target instance via the Clone Admin Console before submitting further clone requests. OAuth setup is a one-time process per target instance, requiring no re-registration unless the session expires or is revoked. ## Practical Benefits for ServiceNow Customers * Increased security by avoiding static local admin credentials. * Simplified administration with one-time OAuth setup per target instance. * Seamless cloning operations using existing login credentials and tokens. * Reduced operational overhead and risk associated with basic authentication. OAuth 2.0 authenticates clone requests to target instances without requiring a local admin account, enabling you to use your existing login credentials. ## Why OAuth 2.0 replaces basic authentication {#clone-oauth-authentication__clone-oauth-authentication-why-oauth} Previously, Instance Clone used basic authentication to confirm access to a target instance. This required maintaining a local admin account specifically for cloning and entering those credentials for each clone request.{#clone-oauth-authentication__clone-oauth-authentication-why-oauth-p1} The OAuth 2.0 Authorization Code Flow enhances security and convenience by providing the following benefits:{#clone-oauth-authentication__clone-oauth-authentication-why-oauth-p2} * No local admin account required - use your existing login credentials, including SSO. * One-time target instance registration. * Automatic token generation and expiration for each clone request. ## How it works {#clone-oauth-authentication__clone-oauth-authentication-how-it-works} The source instance acts as the OAuth client, and the target instance acts as the OAuth authorization server. Authentication happens once per target instance during setup and repeats only if the session expires or is revoked.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p1} During setup, the target instance generates a Client ID that uniquely identifies the source instance as an authorized OAuth client. Administrators copy this Client ID and return it to the source instance to complete registration.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p2} After setup is complete, Instance Clone uses a short-lived JSON Web Token (JWT) access token to authenticate each clone request to the target. The source instance obtains this token automatically before each clone operation.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p3} The clone_admin role is required on the source instance to request clones. The oauth_admin role is required on the target instance during initial setup only.{#clone-oauth-authentication__clone-oauth-authentication-how-it-works-p4} ## Token lifecycle {#clone-oauth-authentication__clone-oauth-authentication-token-lifecycle} The JWT access token has a short time-to-live (TTL) and expires automatically after each use. If a token expires, the system automatically redirects the user to reauthorize on the target instance from the Clone Admin Console before a clone can be requested.{#clone-oauth-authentication__clone-oauth-authentication-token-lifecycle-p1} ## Basic Auth fallback {#clone-oauth-authentication__clone-oauth-authentication-basic-auth-fallback} Basic Auth is available only as a fallback when the OAuth flow fails. Because of recent platform-wide authentication changes, using Basic Auth to authenticate the clone target requires that the target-instance user have:{#clone-oauth-authentication__clone-oauth-authentication-basic-auth-fallback-p1} * the clone_admin role * the soap role * identity_type set to machine on the user record {#clone-oauth-authentication__clone-oauth-authentication-basic-auth-fallback-ul1} Warning: Users with identity_type = machine can no longer log in to the instance UI. This configuration supports Basic Auth for automated and integration traffic only. The identity_type field may not appear on the User form by default. If it isn't visible, add it temporarily using Form Layout. ## One-time setup per target instance {#clone-oauth-authentication__clone-oauth-authentication-setup} OAuth setup is required once per target instance. No re-registration is required for routine clone requests. If a token expires, the system prompts you to select Authorize on the target instance before you can place a clone request.{#clone-oauth-authentication__clone-oauth-authentication-setup-p1} For more information, see [Set up OAuth authentication for a clone target](https://www.servicenow.com/docs/0WkpF66eh~lFhofTEoTMOw "Complete a one-time OAuth setup to register a target instance for cloning. This process generates a Client ID on the target instance and authorizes the connection from the source instance.").