Client Credentials Grant › Inbound Integrations › OAuth Inbound › OAuth authentication › Authentication › Access Management

Release: Australia · Updated: 2026-07-09 · Official documentation · View source

Client credentials grant workflow

Authenticate a client application using a client credentials workflow. The client credentials grant workflow is used by back-end services or system integrations to access ServiceNow® APIs without user involvement.

Before you begin

Role required: oauth_admin, mi_admin, admin

About this task

This workflow describes how a client application (back-end service or system integration) authenticates directly with ServiceNow using its client credentials without user interaction. The application requests an access token using its client ID and client secret, which ServiceNow validates before issuing the token. The client then uses this token to access ServiceNow APIs. ServiceNow validates each request before returning the appropriate response.

Image omitted: mic-client-credentials-workflow.png
Client credentials grant workflow

Procedure

The client application makes a token request to the ServiceNow end point with the following parameters:
```
Method: POST
Endpoint: https://<servicenow_base_url>/oauth_token.do
```

Parameter	Required	Description
`grant_type`	Yes	OAuth 2.0 grant type.Example: `client_credentials`
`client_id`	Yes	Unique identifier for the client application.Example:Y`OUR_CLIENT_ID`
`client_secret`	Yes	Secret associated with the client ID.Example:`YOUR_CLIENT_SECRET`
`scope`	Optional	Requested permissions for the access token.Example:`incident_read``incident_write`

ServiceNow validates the credentials and returns the access token.

Make an API request with the access token.

Include the access token in the Authorization header of each API request.

Method: POST
Endpoint: https://<servicenow_base_url>/api/now/incident  
Authorization: Bearer YOUR_ACCESS_TOKEN

ServiceNow validates the token and returns the appropriate API response.

Note: Use the client credentials grant workflow only with trusted, server-side applications. Maintain the client_secret securely. Ensure that you don’t use the client_secret in client-side environments such as browsers or mobile apps.