Skip to content
ROPC Grant › Inbound Integrations › OAuth Inbound › OAuth authentication › Authentication › Access Management
Release: Australia · Updated: 2026-07-09 · Official documentation · View source

Resource owner password credential grant workflow

This flow is used in legacy or highly controlled environments where secure alternatives aren't feasible. The client app directly collects and sends user credentials to ServiceNow to obtain an access token, making it suitable only for trusted internal use.

Before you begin

Role required: oauth_admin, mi_admin, admin

About this task

This procedure outlines how a trusted client application obtains an access token by directly handling user credentials and uses it to access ServiceNow APIs.

The user logs in through the app, which sends both its own credentials and the user's to ServiceNow. ServiceNow validates the credentials and issues an access token that the app uses to call APIs.

Image omitted: mic-jwt-grant-workflow.png
Resource owner password credential grant workflow

Procedure

  1. The user logs in to the client application.

  2. The client application sends a token request to with the following parameters:

    • Client ID and client secret.
    • Username and password of the user. Example
    Method: POST
Endpoint: https://<servicenow_base_url>/oauth_token.do
Headers: Content-Type: application/x-www-form-urlencoded
ParameterRequiredDescription
`grant_type`YesSpecifies the OAuth grant type.
`client_id`YesThe unique identifier for your client application.Format: YOUR\_CLIENT\_ID
`client_secret`YesThe client application's secret key.Format: YOUR\_CLIENT\_SECRET
`username`YesThe user’s ServiceNow username.
`password`YesThe user’s ServiceNow password.
`scope`OptionalDefines the level of access requested.Example: - incident\_read - incident\_write

  1. ServiceNow validates both the client and user credentials, and returns the access token.

  2. The client uses the access token to call ServiceNow APIs.

    Example

    Method: GET
Endpoint: https://<servicenow_base_url/api/now/incident
Authorization: Bearer YOUR_ACCESS_TOKEN

  3. ServiceNow validates the access token, and returns the API response.