---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Password Grant Flow

# Resource owner password credential grant workflow {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 30. Juni 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

This flow is used in legacy or highly controlled environments where secure alternatives aren't feasible. The client app directly collects and sends user credentials to ServiceNow to obtain an access token, making it suitable only for trusted internal use.

## Vorbereitungen

Role required: <kbd class="ph userinput">oauth_admin, mi_admin, admin</kbd>

## Warum und wann dieser Vorgang ausgeführt wird

This procedure outlines how a trusted client application obtains an access token by directly handling user credentials and uses it to access ServiceNow APIs.

The user logs in through the app, which sends both its own credentials and the user's to ServiceNow. ServiceNow validates the credentials and issues an access token that the app uses to call APIs.
Abbildung : 1. Resource owner password credential grant workflow

## Prozedur

1. The user logs in to the client application.
2. The client application sends a token request to with the following parameters:  
   * Client ID and client secret.
   * Username and password of the user.

   {#resource-owner-password-credential-workflow__ul_ecn_fl5_xfc}

   Example

       Method: POST
       Endpoint: https://<servicenow_base_url>/oauth_token.do
       Headers: Content-Type: application/x-www-form-urlencoded 

   {#resource-owner-password-credential-workflow__table_cdm_km5_xfc__entry__3}

   | Parameter | Required | Description |
   |-|-|-|
   | `grant_type` | Yes | Specifies the OAuth grant type. |
   | `client_id` | Yes | The unique identifier for your client application. Format: YOUR_CLIENT_ID |
   | `client_secret` | Yes | The client application's secret key. Format: YOUR_CLIENT_SECRET |
   | `username` | Yes | The user's ServiceNow username. |
   | `password` | Yes | The user's ServiceNow password. |
   | `scope` | Optional | Defines the level of access requested. Example: * incident_read * incident_write {#resource-owner-password-credential-workflow__ul_yry_jr5_xfc} |
   [Tabelle : 1. Token Request Parameters]

   {#resource-owner-password-credential-workflow__table_cdm_km5_xfc}
3. ServiceNow validates both the client and user credentials, and returns the access token.
4. The client uses the access token to call ServiceNow APIs.  
   Example

       Method: GET
       Endpoint: https://<servicenow_base_url/api/now/incident
       Authorization: Bearer YOUR_ACCESS_TOKEN

5. ServiceNow validates the access token, and returns the API response.