Webkul has published a PHP walkthrough for connecting to ServiceNow's REST API with OAuth 2.0, using the Authorization Code flow. The walkthrough targets the latest Yokohama edition.
The walkthrough covers creating an OAuth application in ServiceNow, approving access via the authorization endpoint, and exchanging the authorization code for an access token via the token endpoint.
The short version:
- The walkthrough uses OAuth 2.0's Authorization Code flow.
- Step one is creating an OAuth application in ServiceNow.
- Step two is approving access via the authorization endpoint.
- Step three is exchanging the code for an access token request.
- The walkthrough includes PHP cURL samples for the token exchange.
Step one: create the OAuth application
Per the Webkul guide, the developer signs into the ServiceNow instance, navigates to System OAuth, and registers a new application. The walkthrough selects Create an OAuth API endpoint for external clients. The developer fills in the basic information fields, adds a Redirect URL, and chooses the Authorization Code grant flow, which uses a client secret for server-side apps.
Step two: approve access via the authorization endpoint
The walkthrough points to the ServiceNow authorization endpoint, oauth_auth.do, with parameters for response_type (code), client_id, redirect_uri and state. The endpoint redirects the user to the ServiceNow login, where the user grants the requested scopes. ServiceNow then sends the code to the redirect_uri.
Step three: exchange the code for an access token
Per the Webkul guide, the developer sends a POST to the token endpoint, oauth_token.do, with parameters for grant_type (authorization_code), client_id, client_secret, redirect_uri and code. The walkthrough includes a PHP cURL sample that posts the parameters and returns the access token, token type, expiry and refresh token. The walkthrough also includes a fragment of the response shape: access_token, token_type, refresh_token, expires_in and scope.
Why this matters
ServiceNow integrations usually live or die on the auth handshake. The walkthrough's honest play is the standard Authorization Code flow, since the standard flow is the secure way. The alternative (username/password or even token-based auth) skips the redirect step but skips the security of the redirect. The trade-off is more code, more code that's harder to debug.
A worked example
Say you are building a PHP middleware that pulls incidents from ServiceNow into a custom dashboard. Don't hard-code credentials, since the database will be the next breach headline. Register an OAuth application in ServiceNow, point the Redirect URI at your middleware's callback, and implement the three-step flow. Store the access token and refresh token in an encrypted store, refresh the token before it expires, and call the API. The honest play is one OAuth app per middleware, one encrypted store per middleware, one middleware per dashboard.
What to watch next
Watch for ServiceNow to ship a managed OAuth client for PHP, since most PHP apps reinvent the wheel. Watch for the token refresh flow to mature, since the token refresh walkthrough is shorter than the auth walkthrough. Watch for PKCE (Proof Key for Code Exchange) to become the default, since PKCE adds security for public clients.
Frequently asked questions
What OAuth 2.0 flow does the guide use?
Per Webkul, the walkthrough uses the Authorization Code grant flow.
Where do I create the OAuth application?
In ServiceNow, navigate to System OAuth and register a new application.
What is the token endpoint?
Per the guide, the token endpoint is oauth_token.do, which exchanges the authorization code for an access token.
What does the access token response include?
The response includes access_token, token_type, refresh_token, expires_in and scope.
Is PKCE supported?
The walkthrough doesn't cover PKCE, but PKCE adds security for public clients and is worth watching.