Skip to content
JWT Bearer › OAuth Outbound › OAuth authentication › Authentication › Access Management
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Set up OAuth provider with JWT Bearer grant type

JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention. This support enables Integration Hub or other automated tasks using JWTs to configure API and Service integrations with different providers.

Before you begin

Role required: oauth_admin

About this task

The following tasks show how ServiceNow can be set up to use JWTs for OAuth 2.0 client authentication and authorization grants. ServiceNow is the OAuth client, and you can configure an OAuth provider, such as Box or Docusign.

Procedure

  1. Upload Java Key Store certificate

    Attach a JKS certificate to your instance to use to enable the JWT client authentication.

  2. Configure a JWT signing key

    Create a JWT signing key to assign to your Java KeyStore (JKS) certificate.

  3. Create a JWT provider with a JWT signing key

    Add a JWT provider to your ServiceNow instance.

  4. Connect to a third-party OAuth provider

    Create a third-party OAuth provider with a JWT Bearer as the default grant type in the ServiceNow Application Registry.

  5. Specify an OAuth profile

    Open the OAuth entity profile of the OAuth provider and assign a JWT provider.

Upload Java Key Store certificate

You can attach a Java KeyStore (JKS) certificate to your instance to use to enable the JWT client authentication.

Before you begin

Role required: oauth_admin

Procedure

  1. Navigate to All > Multi-Provider SSO > x509 Certificate.

  2. Fill in the form as needed.

NameA unique name for your certificate.
Notify on expirationDesignate whom to notify when the certificate expires.
Warn in days to expireSend an email notification to your certificate manager before your certificate expires.
ActiveEnables the certificate to use for token requests.
TypeThe type of certificate you are uploading.
Expires in daysThe amount of days until the certificate expires.
Key store passwordThe password associated with the certificate.
Short description 
  1. Click Submit.

Configure a JWT signing key

Create a JSON Web Token (JWT) signing key to assign to your Java KeyStore (JKS) certificate,

Before you begin

Role required: oauth_admin

Note: If you want to add X.509 Certificate SHA-1 Thumbprint int (x5t) to the header as part of the JWT Key, you must configure the form and add the X.509 Certificate SHA-1 Thumbprint int (x5t) field.

Procedure

  1. Navigate to All > System OAuth > JWT Keys.

  2. Fill in the form as needed.

NameA unique name for your JWT Key signing configuration.
Signing KeystoreThe keystore designated when signing the JWT.
Key IDThe Key ID (kid) helps identify which key is used when multiple keys are used to sign tokens.Note: If you configure this field, the Key ID claim is included in the JWT. If you do not configure this field, your JWT will not have a Key ID claim.
Signing AlgorithmThe algorithm to use to sign with the JWT key. RSA 256 is the only algorithm available.
Signing Key PasswordThe password associated with the signing key.
ActiveDesignate that the JWT key alias is actively referenced from a JWT provider.
  1. Click Submit.

Create a JWT provider with a JWT signing key

Add a JSON Web Token (JWT) provider to your ServiceNow instance.

Before you begin

Role required: oauth_admin

Procedure

  1. Navigate to All > System OAuth > JWT Provider.

  2. Fill in the form and click Submit.

NameA unique name for your JWT provider configuration.
Expiry Interval (sec)The lifespan of the tokens, in seconds, generated by the JWT provider.
Signing ConfigurationThe ServiceNow JWT signing key configuration to apply.