foreign to this series on creating scripted rest apis in servicenow in the previous videos we looked at how we could secure our API its resources as well as the underlying table using access control rules these access controls determine who is allowed to perform which actions in the system in our API now we're going to turn our attention to authentication that is the process of the user logging into the instance so far our scripted rest API is available only using basic authentication that is you have to send the account credentials the username and password with each request and once authenticated that user is permitted to perform the certain actions that the user is authorized to do using our access controls however we would have to provide our account credentials with each request or else rely on cookies but as the client as the external application we have no way of knowing for how long those cookies are valid for how long that session is valid for so what ends up happening is that you're providing your account credentials with nearly every request in any case we need a better way to authenticate without exposing our account credentials every time we send requests and this is where oauth comes into play oauth is today's security standard for authentication it's more secure than basic authentication because it uses access tokens and these access tokens have a limited lifetime but they can be refreshed automatically and they can also be revoked at any time and access tokens give the client permission to perform basically a subset of actions that they account as a whole may be able to perform in the next two videos we're going to take a closer look at how to achieve that access tokens are kind of like a security card for a hotel or your office so once you've provided your account credentials and you've authenticated that you've provided your username your password or your passport and your ID then you get a card and that card allows you access to certain rooms in the hotel or in the office there are lots of resources out there online that you can use to learn about oauth and at the end of this video I'm going to point out one course in particular that is an excellent resource if you really want to get your teeth stuck into oauth for this video however we're just going to provide a quick demonstration of the authentication flow to Grant access tokens to your integration users and by authentication flow I'm not meaning a flow in flow designer but a flow that is defined in the oauth specification itself for granting access tokens to set up all for your external clients and applications is very easy the oauth plugin is already activated in all servicenow instances and the property for activating oauth once that plugin is installed is set to true as well so there's actually nothing there that you have to install or set up it's already there ready to go so the authentication flow that we're going to use in service now here is real easy to set up and the authentication flow itself is the password Grant flow this is defined in the oauth 2.0 specification you will find that that authentication flow is not supported in the 2.1 version but in our case the authentication server and the resource or the API are one and the same thing it's on the same instance of servicenow it's in the same system so we're not unnecessarily exposing account credentials in the transmission between the API and the authentication server so what we need to do is basically to set up a client secret and a client ID and provide those details to our external client or application and then that application will then be able to use that client ID and client secret to request an access token using a HTTP post request to the servicenow instance let's take a look at how to set this up so if we come back to servicenow studio and create a new application file here we'll see that there's actually no option here for creating new oauth configuration object we basically need to register a new application using oauth so we'll need to escape out of there and just come to the regular interface here and then go to oauth system oauth and then application registry we'll need to create a new record here so we've got different options here depending on the relationship of your servicenow instance to the authentication server so because in this case the servicenow instance will also function as the authentication server and we need to provide access to external applications we'll go ahead and select the first option here create an oauth API endpoint for external clients so we go ahead and do that now what we would normally do is give a name here that represents the application that needs to connect to our API but in my case I'm just going to keep this simple and put in vehicle scripted rest API as the name we can see we've got the client ID here as well this functions basically like the username and then once you save the record the client secret will be populated automatically we can also see here on the right hand side the default settings for the life cycle or the the lifespan of an access token as well as the refresh token which is then used to renew or to get a new access token when the old one expires so we'll just leave those values as the default and we'll go ahead and save that record in another video we're going to talk about authentication Scopes which you see here also in the related list this will Define what parts of the API this access token will be granted to use so once we have that client ID and client secret we can then provide those details to the external application and then that's it so but because we also want to see how that process works and we'll go ahead in Postman and take a look at it before we do though if you go to the padlock here next to the client Secret and click on it you'll actually see the client secret itself and then you can just copy that and the client ID as well and send that securely over to the application okay so if we come over to postman I have modified my vehicles demo environment variables here to include the client ID and the client secrets so I've actually pasted those values that we just saw in our servicenow instance there are a couple of ways you can request access tokens in Postman I'm going to show you two ways so the first way will be a request that's actually independent of anything that we actually want to do with the API it's just to get the access token itself but there is a way in Postman which is the second method I'll show you for associating an access token or requesting an access token within the get the posts the delete request itself so if we come over here to my oauth folder which I've created so I've actually made a copy of all the requests and placed them in a new folder and I can then go ahead and modify those requests to include oauth authentication instead of basic off I go ahead here and add a new request give this a name called request access token now we need to or the request needs to use the HTTP post method the URL endpoint here for requesting access tokens in a servicenow instance has the oauth underscore token dot do at the end okay so whatever your instance name is just put that or pen that oauth Etc to the end and that will be fine it's a standard URL okay so what we'll need to do is come to authorization here now depending on where you are in Postman you'll just need to make sure that it's not inheriting anything from the parents so in our case we actually don't need any authentication at all the system will do that on its own we don't need to specify an authentication type here once we do that we'll need to come to the body and select this xww form URL encoded option here and then specify the keys that we need or the parameters that we need to get our access token so the first one is Grant type that will need to be set to password then we go ahead and specify the client ID and the client Secret which we were just looking at and then we'll also go ahead and specify the username and the password for our integration user that we've been using up until this point okay so what will happen is that the system will take this request authenticate that username and password look at the client ID and secret does that match as well and if so it will grant us an access token together with a refresh token so let's go ahead and send that and there we have it we've got both an access token a refresh token we don't have any scope yet but we'll get to that in a later video and you can see also the expiry time here in seconds okay I think the original value was that we had was 1800 and since that request has been received one second is already expired so it's now down to 17.99 okay so that's the first way you can get an access token using Postman but probably what's a little bit easier if you just go to the request itself directly so in our case we'll just use the get vehicle one again that we're using before and we saw here that we're using the basic authentication before we're providing our username and password with every request so what we can do here is just change the authentication type here from basic auth to oauth 2.0 and then we can go ahead here and scroll down and configure or create a new or request a new access token so I'm going to give this one a name with the same name as my integration user vehicle integration so we don't confuse ourselves and the grant type here refers to the authentication flow or the process for actually getting an access token and depending on the relationship between your resources and API and the authentication server and so forth and the application itself requesting the access token there are different possibilities here but for our purposes here we'll need to select the password credentials one okay the parameters underneath change depending on what Grant type you've selected here we'll need to put in the access token URL which is what we saw before and then provide the same parameters that we specify before the client ID the client Secret the username and the password okay the scope we can leave blank again we'll talk about authentic authentication Scopes a little bit later and then under client or next to client authentication we need to put that in the body okay not in the header and then we go ahead and request a new token authentication complete that means we've got a new access token that we can now use to process or send this request okay we can see the details there click on use token and then that's ready to go so now instead of using basic authentication we can use this access token to gain access to the API so if I click on send similar to what we've seen before in previous videos we get the response back in this case a vehicle from our vehicles table so as we saw earlier we get not only an access token but a refresh token and that refresh token is used to request a new access token when that existing one has expired now this time here that I've got at the moment for my ACCESS token I've just waited a little bit before I started the recording again we're past eight minutes past four in the afternoon here now Postman is actually smart enough that when you send a new request if the token is expired it will automatically request a new one but you can actually go ahead and do this manually just by clicking on this link here and once we do that we get a new access token it's valid for another 30 minutes and then we can go ahead and send that request using that new access token so again we're not sending permanent account credentials a username and password we're sending an access token that has a limited lifetime so if that access token were to somehow fall into the wrong hands we will be then able to revoke that access token and if they're able to do anything it would be for a limited period of time and just finally if we look at the actual request itself for basic authentication you can actually see here in the header the basic authentication has been set there and what we see in that first line directly underneath it is our account credentials uh base64 encoded so if you were to actually pop that into a decoding tool for base64 you'll actually see the account credentials so that is actually not encrypted okay it's encoded not encrypted if we have a look at the request itself for the access token we can see the access token are in plain text in the header so that's how you go ahead and set up oauth for use with your scripted rest apis and I hope you agree with me when I say that setting this up is not very difficult at all you just need to create a simple record to generate the client ID and client secret provide those details to the third party and then that third party then can authenticate and request an access token for later requests so now every request that's being sent we're not exposing permanent account credentials we're just sending an access token that has a limited lifespan and by default as we just saw that lifespan was 1800 seconds or 30 minutes but you could actually set that to a shorter time 15 10 minutes whatever you like and in general shorter lifetimes means increase security because if that access token were to fall into the wrong hands then they would only have a very limited amount of time to do anything right in your system so now that we've discussed oauth we've used it but we can still see in our testing that we can authenticate using basic authentication we can still authenticate with our account username and password in the next video we're going to change that so we're going to tighten the screws even more on our API and enforce oauth security and we do that using API access policy so stay tuned for that one foreign