---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set up OAuth provider with JWT Bearer grant type

# Set up OAuth provider with JWT Bearer grant type {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read  
JSON Web Tokens (JWTs) enable the capability to configure server-to-server API
interactions between ServiceNow and
external API providers without requiring any user intervention. This support enables Integration Hub or other automated
tasks using JWTs to configure API and Service integrations with different
providers.

## Before you begin

Role required: oauth_admin

## About this task

Configure your ServiceNow instance to use JWTs for OAuth 2.0 client authentication and authorization grants. Your ServiceNow instance acts as the OAuth client, and you configure an OAuth
provider such as Box or Docusign.{#JWT-Bearer-token-support__JWT-Bearer-token-support-context-1}

## Procedure

1. [Upload Java Key Store certificate](https://www.servicenow.com/docs/tvE88Yvk9uZMK2wKkOHMaQ#upload-jks-certificate "You can attach a Java KeyStore (JKS) certificate to your instance to use to enable the JWT client authentication.")  
   Attach a JKS certificate to your instance to use to enable the JWT client authentication.
2. [Configure a JWT signing key](https://www.servicenow.com/docs/tvE88Yvk9uZMK2wKkOHMaQ#configure-JWT-signing-key "Create a JSON Web Token (JWT) signing key. The key can be a certificate uploaded to the instance, or a private key managed by the Key Management Framework (KMF).")  
   Create a JWT signing key to assign to your JKS certificate.  
   Note:  
   Starting in the Brazil release, ES256 (ECDSA with SHA-256) is available as a signing algorithm option. Select ES256 in the Signing Algorithm field when your third-party OAuth provider requires an ECDSA-signed JWT. The default is RS256.
3. [Create a JWT provider with a JWT signing key](https://www.servicenow.com/docs/tvE88Yvk9uZMK2wKkOHMaQ#associate-jwt-provider-key "Add a JSON Web Token (JWT) provider to your ServiceNow instance.")  
   Add a JWT provider to your ServiceNow instance.
4. [Connect to a third-party OAuth provider](https://www.servicenow.com/docs/yU69xzj7L7lgD2HvdocRSA "Configure how the client ID and secret are sent to your OAuth provider.")  
   Create a third-party OAuth provider with a JWT Bearer as the default grant type in the ServiceNow Application Registry.
5. [Specify an OAuth profile](https://www.servicenow.com/docs/access?context=t_SpecifyAnOAuthProfile&version=brazil&pubname=brazil-api-reference&ft:locale=en-US)  
   Open the OAuth entity profile of the OAuth provider and assign a JWT provider.

## Upload Java Key Store certificate {#ariaid-title2}

You can attach a Java KeyStore (JKS) certificate to your instance to use to enable
the JWT client authentication.

### Before you begin

Role required: oauth_admin

### Procedure

1. Navigate to AllMulti-Provider SSOx509 Certificate.
2. Fill in the form as needed.

   | Option | Description |
   | Name | A unique name for your certificate. |
   | Notify on expiration | Designate whom to notify when the certificate expires. |
   | Warn in days to expire | Send an email notification to your certificate manager before your certificate expires. |
   | Active | Enables the certificate to use for token requests. |
   | Type | The type of certificate you are uploading. |
   | Expires in days | The amount of days until the certificate expires. |
   | Key store password | The password associated with the certificate. |
   | Short description |   |
   |-|-|

   {#upload-jks-certificate__choicetable_yqx_5f2_1gb}
3. Click Submit.

## Configure a JWT signing key {#ariaid-title3}

Create a JSON Web Token (JWT) signing key. The key can be a certificate uploaded to the instance, or a private key managed by the Key Management Framework (KMF).

### Before you begin

Role required: `oauth_admin`

When Key Source is KMF Cryptographic Module, you also need the `sn_kmf.*` roles required to reference the KMF crypto module.

### About this task

Note:  
You must have a single entry in the keystore. The system reads the keystore and selects the first alias, so make sure the associated keystore's first entry is the certificate you intend to use.

### Procedure

1. Navigate to AllSystem OAuthJWT Keys.
2. Fill in the form as needed.  
   {#configure-JWT-signing-key__table_q41_y42_fkc__entry__2}

   | Field | Description |
   |-|-|
   | Name | A unique name for the JWT Key signing configuration. Required. |
   | Key Source | Choice to select the key either directly from a keystore or from the Key Management Framework. Required. Choices: * Signing Keystore --- Use a certificate uploaded to the instance. The Signing Keystore field is required. Signing Algorithm is read-only when this option is selected. * KMF Cryptographic Module --- Use a private key managed by the Key Management Framework (KMF). The KMF Crypto Module field is required. The Signing Algorithm is set automatically from the module's asymmetric crypto specification. Fields that only apply to Signing Keystore (Signing Keystore, Key Id) are hidden. {#configure-JWT-signing-key__ul_r41_y42_fkc} |
   | Signing Keystore | Reference to the keystore to use when signing the JWT. Required when Key Source is Signing Keystore. |
   | Key Id | The key identifier to send in the `kid` claim. If you configure this field, the Key Id claim is included in the JWT. If you don't configure this field, the JWT does not include a Key Id claim. |
   | X.509 Certificate SHA-1 Thumbprint (x5t) | Include the `x5t` claim (X.509 certificate base64url-encoded SHA-1 thumbprint) in the JWT header. To use this field, configure the form to add it. |
   | Signing Algorithm | The signing algorithm to use. Read-only when Key Source is KMF Cryptographic Module --- the algorithm is derived from the selected KMF Crypto Module. Choices: * RSA 256 (default) --- RSA signature with SHA-256. * ES256 --- ECDSA signature using the P-256 curve with SHA-256. {#configure-JWT-signing-key__ul_s41_y42_fkc} |
   | Signing Key | The shared secret or password associated with the signing key. Applies to Signing Keystore. |
   | KMF Crypto Module | Reference to a KMF cryptographic module that manages the signing for this alias. Required when Key Source is KMF Cryptographic Module. When you select a module, the instance reads the module's asymmetric crypto specification and sets the Signing Algorithm accordingly. If the selected module has no asymmetric crypto specification, an error appears at the top of the form and the record can't be saved. |
   | Application | The application scope for the JWT Key record. Defaults to Global. |
   | Active | Whether the JWT Keystore Alias is active and referenced from a JWT provider. |
   [ ]

   {#configure-JWT-signing-key__table_q41_y42_fkc}
3. Select Submit.
{#configure-JWT-signing-key__steps}

## Create a JWT provider with a JWT signing key {#ariaid-title4}

Add a JSON Web Token (JWT) provider to your ServiceNow instance.

### Before you begin

Role required: oauth_admin

### Procedure

1. Navigate to AllSystem OAuthJWT Provider.
2. Fill in the form and click Submit.

   | Option | Description |
   | Name | A unique name for your JWT provider configuration. |
   | Expiry Interval (sec) | The lifespan of the tokens, in seconds, generated by the JWT provider. |
   | Signing Configuration | The ServiceNow JWT signing key configuration to apply. |
   |-|-|

   {#associate-jwt-provider-key__choicetable_yqx_5f2_1gb}

*[\>]: and then