OAuth authorization code grant flow
-
- UpdatedAug 3, 2023
- 3 minutes to read
- Vancouver
- Platform Security
OAuth authorization code grant flow
Authorization code grant flow allows a user to access a resource by authenticating directly with an OAuth server that trusts the resource, in contrast with authenticating with username/password credentials.
This implementation of OAuth authorization code flow allows access to a resource via REST. The authorization code framework gets the access token through the authorized URL that the user configures rather than requiring the user to enter a username/password. The username/password are never exposed to the client that is requesting access to the resource.
A ServiceNow instance as the authorization server
The OAuth server is typically a third-party authorization server. You can also specify a ServiceNow instance as the authorization server that issues the tokens for authorization code flow.
The user who owns the restricted resource must authorize access. The user can also revoke the issued access token at any time to terminate access.
Authorization code grant flow process
The Authorization code grant flow process consists of these three steps:
In step one, the client application or website initiates a REST API call in the form of a GET request to the instance via the user agent. Typically, the REST call is initiated when the end user clicks a button or a link on the client application or website to request an access token. In the client application, the end user also has to specify the authorization URL, token URL, client ID, and client secret. For an explanation of these items, see the field descriptions in this topic: Use a third-party OAuth provider. If the client asks for a grant type, the end user must select Authorization Code.
The item that the client application is actually requesting the token from is the OAuth provider application registry record that you created, also known as the authorization endpoint (see Use a third-party OAuth provider). The auth code is sent from the authorization endpoint to the client. It does not go to the client directly but to the Redirect URL that you specify on the authorization endpoint form. This URL is also known as a callback URL. You can obtain this URL from the client application or website.
Now that the client application has the authorization code, the client uses the code to request the access token. The authorization code proves that the user has consented in step 1.
The endpoint on the instance returns an access token and a refresh token. The refresh token can be used to request additional access tokens.
You can manage the tokens, including revoking the token, in the instance. See Manage OAuth tokens.
The client application uses the access token to authenticate to the REST API. After authenticating the client application, the REST API returns the requested data in a JSON payload.
Integration support
- Multi-SSO
- SAML 2.0 Update 1
- Multifactor authentication
The mobile interface is also supported.