---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# OAuth API request parameters

# OAuth API request parameters {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of OAuth API request parameters

This document outlines the key OAuth API request parameters used in access token requests within ServiceNow.
It is essential for customers integrating OAuth authentication to use the correct parameters and content-type to successfully obtain access tokens for API access.
Show full answer Show less  
Note that the OAuth API requires the **content-type** to be `application/x-www-form-urlencoded`. Using `application/json` will cause unspecified errors.

## Key Parameters

* **granttype** (required): Specifies the credential type authorizing the access token request. Valid values are:
  * `password`: uses user credentials via `username` and `password` parameters.
  * `refreshtoken`: uses an existing refresh token via the `refreshtoken` parameter.
* **clientid** (required): The unique, auto-generated identifier of the client application requesting the token.
* **clientsecret** (required): Shared secret string used for client and instance authentication.
* **username** : Required only when `granttype=password`. Specifies the user account name authorizing the request.
* **password** : Required only when `granttype=password`. Specifies the user account password.
* **refreshtoken** : Required only when `granttype=refreshtoken`. Specifies the existing refresh token to obtain a new access token.

## Request Types and Behavior

**Requests Using User Credentials (granttype=password):**

* Clients must provide valid user credentials initially or when requesting a new refresh token.
* Successful requests return both an access token and a refresh token.
* The instance verifies the user's active status, access lockout state, and interactive session before issuing tokens.
* Subsequent requests within the access token's lifetime return the current access token.
* Transmission of user credentials is secured via TLS encryption.

**Requests Using a Refresh Token (granttype=refreshtoken):**

* Clients use an existing refresh token to obtain a new access token without user credentials.
* Only an access token is returned.
* The refresh token's validity is confirmed before issuing a new access token.
* Refresh tokens offer greater security compared to transmitting user credentials.
* Requests within the refresh token's expiration return the current refresh token.

## Practical Application

ServiceNow customers implementing OAuth authentication should ensure their token requests use the specified parameters with `application/x-www-form-urlencoded` content-type. For initial authorization, use `granttype=password` with username and password. For token renewal, use `granttype=refreshtoken` with a valid refresh token.

Examples provided demonstrate the correct cURL command syntax for both methods, guiding customers to integrate OAuth token requests effectively and securely.  
Learn about the OAuth API request parameters that access token requests
use.
Note:  
The content-type of the OAuth API should be application/x-www-form-urlencoded. A content-type of application/json results in an unspecified error.  
{#r_OAuthAPIRequestParameters__table_awk_zyv_yq__entry__2}

| Request parameter | Description |
|-|-|
| grant_type | \[Required\] The type of credentials authorizing the request for an access token. This parameter must have one of the following values: * password: A set of user credentials to authorize the access token request. Specify the user credentials in the username and password parameters. * refresh_token: An existing refresh token authorizes the access token request. Specify the refresh token in the refresh_token parameter. {#r_OAuthAPIRequestParameters__ul_dd1_hzv_yq} |
| client_id | \[Required\] Auto-generated unique ID of the client application requesting the access token. |
| client_secret | \[Required\] Shared secret string that the instance and the OAuth application use to authorize communications with one another. |
| username | User account name that authorizes the access token request. This parameter is required for access token requests with a grant_type of password. |
| password | Password for the user account that authorizes the access token request. This parameter is required for access token requests with a grant_type of password. |
| refresh_token | Existing refresh token that authorizes the access token request. This parameter is required for access token requests with a grant_type of refresh_token. |
[Table 1. Access token request parameters]

{#r_OAuthAPIRequestParameters__table_awk_zyv_yq}

## Requests Using User Credentials

The instance requires clients to provide user login credentials when first authorizing the
client or when authorizing the creation of a new refresh token. This type of request always
returns two tokens:  
* An access token
* A refresh token
{#r_OAuthAPIRequestParameters__ul_kyh_pzv_yq}

The instance verifies that the user is active, not currently locked out, and has an
interactive session. If any of these conditions are false, the instance does not produce an
access token. Access requests made within the expiration time of the access token always
return the current access token.  
Note:  
This type of authorization grant relies on TLS encryption to protect the user credentials during transmission.

The following example illustrates requesting an access token with a set of user credentials (Spaces have been added to improve readability).  


    $ curl -d"grant_type=password&client_id=be3aeb583ace210011c15b24a43e25d8
    &client_secret=client_password
    &username=admin&password=admin" 
    https://instancename.service-now.com/oauth_token.do

## Requests Using a Refresh Token

The instance can use an existing refresh token to create a new access token. This type of request returns only an access token. The instance confirms that the refresh token has not expired before generating a new access token.
Access requests made within the refresh token expiration time always return the current refresh token. Transmitting refresh tokens is generally more secure than transmitting user credentials. The following example illustrates
requesting an access token with an existing refresh token (Spaces have been added to improve readability).  


    $ curl -d"grant_type=refresh_token&client_id=be3aeb583ace210011c15b24a43e25d8
    &client_secret=client_password
    &refresh_token=w599voG89897rGVDmdp12WA681r9E5948c1CJTPi8g4HGc4NWaz62k6k1K0FMxHW40H8yOO3Hoe" 
    https://instancename.service-now.com/oauth_token.do