---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# OAuth Code Grant

# Authorization code grant {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

The OAuth authorization code grant is a secure and widely used flow for web, mobile, or desktop apps
that access user data with user consent. It supports both private clients (using a client secret), and public clients (using PKCE).  
In this flow, ServiceNow functions as both the authorization server (handling user authentication and token issuance) and the resource server (hosting the APIs). If SSO is enabled, ServiceNow redirects the user to the configured Identity Provider (IdP) for authentication. After the IdP successfully authenticates the user, control returns to ServiceNow, which then issues the authorization code. This process ensures that even with external authentication, ServiceNow remains the authority for issuing tokens and managing API access.

Ideal for:
:   Applications that need to access user data on behalf of user with the user's consent.

How it works:
:   The user initiates the login process from the client application, which redirects them to a ServiceNow login page. After the user logs in and grants consent, the client application receives an authorization code, which it
    exchanges with the ServiceNow instance for an access token. This is the most secure and widely used flow for user-facing integrations. It supports both confidential clients (with a client secret) and public clients (using
PKCE).  
Hinweis:  
If you want to use your own identity provider (such as Azure AD or Okta) as the authorization server, consider using the flow.
**Zugehörige Tasks**   

* [Authorization code grant workflow](https://servicenow-prod.fluidtopics.net/DnlJhu7zLAFshDc8KydH2g "ServiceNow handles both authentication and API access by acting as the authorization and resource server. When single sign-on (SSO) is enabled, it redirects users to the configured IdP for authentication and issues tokens after successful login.")
* [Configure an OAuth authorization code grant](https://servicenow-prod.fluidtopics.net/FedB9gfp0egAJkBcA15lOQ "Configure the OAuth authorization code grant to enable secure and interactive user authentication to enable applications to access resources on behalf of users. The OAuth authorization code grant verifies that the API access is granted based on the user identity and permissions.")