OAuth API request parameters

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of OAuth API request parameters

    This documentation explains the OAuth API request parameters used in ServiceNow to obtain access tokens for authentication. It specifically covers the parameters required for access token requests in the Zurich release, highlighting the importance of correct content-type and parameter usage.

    Show full answer Show less

    Key Features

    • Content-Type Requirement: Requests must use application/x-www-form-urlencoded content-type. Using application/json will cause unspecified errors.
    • Required Parameters:
      • granttype: Specifies the type of authorization. Valid values are password (user credentials) or refreshtoken (existing refresh token).
      • clientid: The unique client application ID.
      • clientsecret: The shared secret between the instance and OAuth application.
    • Additional Parameters Based on Grant Type:
      • username and password: Required when granttype=password to supply user credentials.
      • refreshtoken: Required when granttype=refreshtoken to provide an existing refresh token.
    • Token Responses:
      • Requests using user credentials return both an access token and a refresh token.
      • Requests using a refresh token return only a new access token.
    • Security Considerations:
      • User credentials must be transmitted over TLS to ensure security.
      • Refresh tokens are more secure to transmit than user credentials and can be used to obtain new access tokens without resubmitting credentials.

    Practical Usage

    When requesting an access token, ensure that you:

    • Set the content-type header to application/x-www-form-urlencoded.
    • Include all required parameters depending on the grant type.
    • Use TLS encryption to protect credentials.
    • For initial authorization, use granttype=password with user credentials to receive both tokens.
    • For subsequent authorizations, use granttype=refreshtoken with a refresh token to get a new access token.

    Example curl commands illustrate how to structure the request data for both grant types.

    Learn about the OAuth API request parameters that access token requests use.

    Note:
    The content-type of the OAuth API should be application/x-www-form-urlencoded. A content-type of application/json results in an unspecified error.
    Table 1. Access token request parameters
    Request parameter Description
    grant_type [Required] The type of credentials authorizing the request for an access token. This parameter must have one of the following values:
    • password: A set of user credentials to authorize the access token request. Specify the user credentials in the username and password parameters.
    • refresh_token: An existing refresh token authorizes the access token request. Specify the refresh token in the refresh_token parameter.
    client_id [Required] Auto-generated unique ID of the client application requesting the access token.
    client_secret [Required] Shared secret string that the instance and the OAuth application use to authorize communications with one another.
    username User account name that authorizes the access token request. This parameter is required for access token requests with a grant_type of password.
    password Password for the user account that authorizes the access token request. This parameter is required for access token requests with a grant_type of password.
    refresh_token Existing refresh token that authorizes the access token request. This parameter is required for access token requests with a grant_type of refresh_token.

    Requests Using User Credentials

    The instance requires clients to provide user login credentials when first authorizing the client or when authorizing the creation of a new refresh token. This type of request always returns two tokens:

    • An access token
    • A refresh token

    The instance verifies that the user is active, not currently locked out, and has an interactive session. If any of these conditions are false, the instance does not produce an access token. Access requests made within the expiration time of the access token always return the current access token.

    Note:
    This type of authorization grant relies on TLS encryption to protect the user credentials during transmission.

    The following example illustrates requesting an access token with a set of user credentials (Spaces have been added to improve readability).

    
$ curl -d"grant_type=password&client_id=be3aeb583ace210011c15b24a43e25d8
&client_secret=client_password
&username=admin&password=admin" 
https://instancename.service-now.com/oauth_token.do

    Requests Using a Refresh Token

    The instance can use an existing refresh token to create a new access token. This type of request returns only an access token. The instance confirms that the refresh token has not expired before generating a new access token. Access requests made within the refresh token expiration time always return the current refresh token. Transmitting refresh tokens is generally more secure than transmitting user credentials. The following example illustrates requesting an access token with an existing refresh token (Spaces have been added to improve readability).

    
$ curl -d"grant_type=refresh_token&client_id=be3aeb583ace210011c15b24a43e25d8
&client_secret=client_password
&refresh_token=w599voG89897rGVDmdp12WA681r9E5948c1CJTPi8g4HGc4NWaz62k6k1K0FMxHW40H8yOO3Hoe" 
https://instancename.service-now.com/oauth_token.do