---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# OAuth API request parameters

# OAuth API request parameters {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of OAuth API Request Parameters

The OAuth API allows ServiceNow customers to request access tokens using specific parameters.
It is essential to use the content typeapplication/x-www-form-urlencodedto avoid errors.
Show full answer Show less  

## Key Features

* **Grant Types:** There are two primary methods to obtain an access token:
  * **Password:** Requires user credentials (username and password).
  * **Refresh Token:** Uses an existing refresh token to obtain a new access token.
* **Required Parameters:**
  * **granttype:** Identifies the type of authorization.
  * **clientid:** Unique identifier for the client application.
  * **clientsecret:** Shared secret for communication authorization.
* **User Credentials:** Must be provided for password grant type requests, ensuring the user is active and not locked out.
* **Security:** TLS encryption is used to protect user credentials during transmission.

## Key Outcomes

When requesting an access token with user credentials, the response includes both an access token and a refresh token. For requests using a refresh token, only a new access token is returned, assuming the refresh token is valid. This process enhances security by reducing the need to transmit user credentials frequently.  
Learn about the OAuth API request parameters that access token requests
use.
Note:  
The content-type of the OAuth API should be application/x-www-form-urlencoded. A content-type of application/json results in an unspecified error.  
{#r_OAuthAPIRequestParameters__table_awk_zyv_yq__entry__2}

| Request parameter | Description |
|-|-|
| grant_type | \[Required\] The type of credentials authorizing the request for an access token. This parameter must have one of the following values: * password: A set of user credentials to authorize the access token request. Specify the user credentials in the username and password parameters. * refresh_token: An existing refresh token authorizes the access token request. Specify the refresh token in the refresh_token parameter. {#r_OAuthAPIRequestParameters__ul_dd1_hzv_yq} |
| client_id | \[Required\] Auto-generated unique ID of the client application requesting the access token. |
| client_secret | \[Required\] Shared secret string that the instance and the OAuth application use to authorize communications with one another. |
| username | User account name that authorizes the access token request. This parameter is required for access token requests with a grant_type of password. |
| password | Password for the user account that authorizes the access token request. This parameter is required for access token requests with a grant_type of password. |
| refresh_token | Existing refresh token that authorizes the access token request. This parameter is required for access token requests with a grant_type of refresh_token. |
[Table 1. Access token request parameters]

{#r_OAuthAPIRequestParameters__table_awk_zyv_yq}

## Requests Using User Credentials

The instance requires clients to provide user login credentials when first authorizing the
client or when authorizing the creation of a new refresh token. This type of request always
returns two tokens:  
* An access token
* A refresh token
{#r_OAuthAPIRequestParameters__ul_kyh_pzv_yq}

The instance verifies that the user is active, not currently locked out, and has an
interactive session. If any of these conditions are false, the instance does not produce an
access token. Access requests made within the expiration time of the access token always
return the current access token.  
Note:  
This type of authorization grant relies on TLS encryption to protect the user credentials during transmission.

The following example illustrates requesting an access token with a set of user credentials (Spaces have been added to improve readability).  


    $ curl -d"grant_type=password&client_id=be3aeb583ace210011c15b24a43e25d8
    &client_secret=client_password
    &username=admin&password=admin" 
    https://instancename.service-now.com/oauth_token.do

## Requests Using a Refresh Token

The instance can use an existing refresh token to create a new access token. This type of request returns only an access token. The instance confirms that the refresh token has not expired before generating a new access token.
Access requests made within the refresh token expiration time always return the current refresh token. Transmitting refresh tokens is generally more secure than transmitting user credentials. The following example illustrates
requesting an access token with an existing refresh token (Spaces have been added to improve readability).  


    $ curl -d"grant_type=refresh_token&client_id=be3aeb583ace210011c15b24a43e25d8
    &client_secret=client_password
    &refresh_token=w599voG89897rGVDmdp12WA681r9E5948c1CJTPi8g4HGc4NWaz62k6k1K0FMxHW40H8yOO3Hoe" 
    https://instancename.service-now.com/oauth_token.do