---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set automatic token cleanup for token credentials

# Set automatic token cleanup for token credentials {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.
If the com.snc.platform.security.token.auth.cleanup system property is set to the insecure value of false, expired API keys and HMAC secrets will not be deleted. This creates a
potential for token reuse. If the token was expired due to leakage or compromise, reuse exposes the instance to anyone possessing the leaked token. Expired tokens are kept for the number of days defined by the
com.snc.platform.security.token.auth.days.expired.hmac_secret.is.kept and com.snc.platform.security.token.auth.days.expired.api_key.is.kept system properties. Integer values of
<kbd class="ph userinput">0</kbd> and greater are valid values. A value of 0 causes the expired tokens to be deleted in the same day. The default of 7 days, or fewer, is recommended.

Ensure the property com.snc.platform.security.token.auth.cleanup doesn't exist in the System Properties \[sys_properties\] table or is set to true. Ensure that the properties
com.snc.platform.security.token.auth.days.expired.api_key.is.kept and com.snc.platform.security.token.auth.days.expired.hmac_secret.is.kept don't exist in the System Properties
\[sys_properties\] table or are set to 7 or less.

## More information {#sc-set-automatic-token-cleanup-for-token-credentials__section_qhx_1b1_xwb}

{#sc-set-automatic-token-cleanup-for-token-credentials__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | * com.snc.platform.security.token.auth.cleanup * com.snc.platform.security.token.auth.days.expired.hmac_secret.is.kept * com.snc.platform.security.token.auth.days.expired.api_key.is.kept {#sc-set-automatic-token-cleanup-for-token-credentials__ul_fmy_gdg_p3c} |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | * true * Less than or equal to 7 * Less than or equal to 7 {#sc-set-automatic-token-cleanup-for-token-credentials__ul_cbw_mdg_p3c} |
| Default value | * true * 7 * 7 {#sc-set-automatic-token-cleanup-for-token-credentials__ul_default_values} |
| Fallback value | * true * 7 * 7 {#sc-set-automatic-token-cleanup-for-token-credentials__ul_l41_qdg_p3c} |
| Category | [Architecture, design, and threat modeling](https://www.servicenow.com/docs/flZLwb5A4NTOzIsm_05BPA "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Severity score: 5.1 * CVSS score: Medium * Security risk details: A high number of days increases the exposure period for token reuse. {#sc-set-automatic-token-cleanup-for-token-credentials__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-set-automatic-token-cleanup-for-token-credentials__table_ajc_b43_3kb}