---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# OAuth authentication

# OAuth inbound and outbound authentication {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
OAuth based authentication validates the identity of the client that attempts to establish a trust on the system by using an authentication protocol.

OAuth 2.0 - Open Authorization is the industry-standard protocol for authorization that focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, and mobile
devices.

It is a standard that enables a website or application to access resources hosted by other web apps on behalf of a user.

Instead of using the resource user's credentials to access protected resources, the client obtains an access token. Access tokens are issued to third-party clients with the user's approval. The client then uses the access token to
access the protected resources.

From Zurich, you can configure OAuth integration with the following enhancements:

* Increase client secret length to 2048 characters to meet security requirements of third-party systems like Azure DevOps (ADO).
* Provide a JSON Web Key Set (JWKS) URL to automatically manage and update the public key for JSON Web Tokens (JWT) signature validation.
* Request OAuth tokens using the JWT grant type signed with Enhanced Security (ES) algorithms.
* Configure a unique identifier for JWT tokens.

{#api-inbound-and-outbound__ul_h3n_xz4_cfc}

## Inbound {#api-inbound-and-outbound__section_rjz_bgl_nwb}

Create an endpoint for external clients that want to access your instance. This creates an OAuth client application record and generates a client ID and client secret that the client needs to access the restricted resources on
the instance. For more information, see [OAuth inbound](https://www.servicenow.com/docs/pmiLPtw7E6o5Y8MdkgHGdQ "OAuth Inbound authentication allows trusted external applications to securely access ServiceNow APIs, helping to keep connections controlled and authorized.").

## Outbound {#api-inbound-and-outbound__section_xtz_cgl_nwb}

Use a third-party OAuth provider that provides the authorization for access to your instance. Specify an OAuth profile and OAuth scope when you are connecting to another OAuth provider. For more information, see [OAuth outbound](https://www.servicenow.com/docs/~nfFUZ0iy~txT3RH4A_zmA "OAuth outbound enables you to pull data from a third party provider to your instance.").