---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configure API key - Token-based authentication

# Configure API key - Token-based authentication {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Configure an API key to support authentication for REST API endpoints.

## Before you begin

Role required: api_service_admin, adaptive_auth_policy_admin

Plugin required: API Key and HMAC Authentication (<kbd class="ph userinput">com.glide.tokenbased_auth</kbd>)

## Procedure

1. Create an inbound authentication profile.
   1. Navigate to AllSystem Web ServicesAPI Access PoliciesInbound Authentication Profiles.
   2. Select New.  
      The system displays the message What kind of authentication profile?
   3. Select Create API Key authentication profiles.  
   4. On the form, fill in the fields.  
      {#configure-api-key__table_pdg_vvm_nzb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Name to identify the authentication policy. |
      | Application | Scope of the authentication policy. |
      | Auth Parameter | Select the auth parameter for the authentication request. You can select the default options or create a new auth parameter: * x-sn-apikey: Auth Header * x-sn-apikey: Query Parameter header {#configure-api-key__ul_vpl_bwm_nzb} |
      [Table 1. API Key authentication profiles]

      {#configure-api-key__table_pdg_vvm_nzb}  
      Note:  
      The selected option has to be defined in the REST call in the Auth Header or Query Parameter.  
      Note:  
      If you wish to add a prefix for the API-Key, Open the Auth Parameter file that you have selected and specify the Prefix field.
   5. Submit the form.
2. Create a REST API key.
   1. Navigate to AllSystem Web ServicesAPI Access PoliciesREST API Key.
   2. Select New.
   3. On the form, fill the fields:  
      {#configure-api-key__table_ehg_jtx_mzb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Name to identify the REST API Key |
      | Description | Description for the REST API Key. |
      | Active | Status of the REST API Key. |
      | User | User associated to the REST API Key. Use the look-up icon to select the user. |
      | Auth Scope | Option to add auth scope to manage the authority of the REST API Key. |
      | Token | The REST API key generated by the ServiceNow AI Platform. Copy the key to use as part of the REST API call within the Header or Query parameter. |
      | Expiry | Time after which the credential is no longer valid. Empty value means no expiration. Note: For more information, about expiry of token, see [Cleaning up token Expiry](https://www.servicenow.com/docs/ZWMx9kTOfXXGLippdTz4IA "Details about how to clean up token expiry by using different system properties.") . |
      [Table 2. API Key]

      {#configure-api-key__table_ehg_jtx_mzb}
   4. Submit the form.
   5. Open the record that was created to view the token generated by the ServiceNow AI Platform for the user.  
   {#configure-api-key__substeps_j4w_dtx_mzb}
3. Create a REST API Access policy.
   1. Navigate to AllSystem Web ServicesREST API Access Policies.
   2. Select New.
   3. On the form, fill in the fields.  
      {#configure-api-key__table_d4x_w45_d4b__entry__2}

      | Field | Description |
      |-|-|
      | Name | Unique name of the API access policy. |
      | Active | Option to make the API access policy active. |
      | REST API | The REST API to which the access policy is applied. For example, Attachment API. |
      | REST API PATH | API path of the REST API. This field is auto-populated based on the selected REST API. For example, now/attachment. |
      | HTTP Method | Method used for interacting with the API. This field is auto-populated based on the selected REST API. |
      | Version | Version of the API. For example, v1. This field is auto-populated based on the selected REST API. Note: If you want to create an authentication policy for all versions of a REST API, you must create individual policies for each version. |
      | Resource | Child resource of the REST API. This field is auto-populated based on the selected REST API. For example, /now/attachment |
      | Application | Scope of the application. |
      | Global | Enable this field to apply auth policy to all methods, versions, and resources for the API. Note: Token Based Auth isn't allowed in the Global REST API Policy. |
      | Apply to all methods | Enable this field to apply the auth policy for the API to all the methods, versions, and resources for the API. |
      | Apply to all resources | Enable this field to apply the auth policy for the API to all the versions. |
      | Apply to all versions | Enable this field to apply the auth policy for the API to all the resources. |
      [Table 3. API Access Policies]

      {#configure-api-key__table_d4x_w45_d4b}
   4. Add the API Authentication profile that was created.
   5. Submit the form.

   {#configure-api-key__substeps_ypz_h5x_mzb}  
   You can send the REST API call with the x-sn-apikey (token) that was generated by the ServiceNow AI Platform during the API Key creation within the Header or Query parameter based on the configuration for authentication.  
   Warning:  
   Use POST request when submitting any sensitive information to the server.

*[\>]: and then