---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# API Key and HMAC Authentication for inbound REST APIs

# API Key and HMAC Authentication for inbound REST APIs {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Support API tokens for REST API endpoints so that the ServiceNow® user name and password isn't visible in the webhook URL.

Enable API key-based authentication to securely authenticate inbound webhook URL.

To use the API Key and HMAC Authentication, you must install the (Plugin: <kbd class="ph userinput">com.glide.tokenbased_auth</kbd>) in the ServiceNow® instance.  
Warnung:  
Use POST request when submitting any sensitive information to the server.

Installing API Key and HMAC Authentication has dependencies on the following plugins:

* REST API Auth Scope Plugin (<kbd class="ph userinput">com.glide.rest.auth.scope</kbd>)
* REST API Access Policy Plugin (<kbd class="ph userinput">com.glide.rest.policy</kbd>)
* Authentication scope (<kbd class="ph userinput">com.glide.auth.scope</kbd>)

{#api-key-and-hmac-rest-apis__ul_wtt_nnv_jzb}

## Benefits {#api-key-and-hmac-rest-apis__section_vhw_dnv_jzb}

API Key and HMAC Authentication for inbound REST APIs enables:

* Ability to specify API key or HMAC token for REST API authentication.
* Ability to associate a user account with the API key or HMAC token.
* Ability to specify a token as query parameter or header within the REST API call.
* Ability to associate authentication scope with API key or HMAC token configurations so that API keys can only be used to invoke APIs associated with a particular scopes.
* Ability to associate an API key or HMAC token configuration with an authentication profile that can be used in API access policies.
{#api-key-and-hmac-rest-apis__ul_lcb_dbw_fzb}