---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# ROPC Grant

# Resource owner password credential grant {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 30. Juni 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Configuring an OAuth Resource Owner Password Credential (ROPC) grant enables applications to authenticate users by directly using their credentials to obtain an access token.

Ideal for:
:   Highly trusted internal client applications in controlled environments where the app collects the user's credentials directly.

How it works:
:   The client application collects the user's username and password and sends them directly to the ServiceNow instance to obtain an access token. This flow bypasses redirection and consent screens but exposes user credentials to the client application, so it should only be used in
    legacy or tightly controlled environments where more secure alternatives are not feasible.

## Security Considerations {#resource-owner-password-grant__section_npq_3s5_xfc}

The ROPC flow exposes user credentials directly to the client application, making it inherently less secure than modern alternatives. It should only be used in scenarios where the client is fully trusted, tightly controlled,
and securely managed.

Avoid using this grant in modern applications unless absolutely necessary. For secure user-based access, it is strongly recommended to use the Authorization Code Flow with PKCE, which keeps credentials out of the client and
leverages secure redirection and token handling practices.
**Zugehörige Tasks**   

* [Resource owner password credential grant workflow](https://servicenow-prod.fluidtopics.net/sRM4Fy9U4QaXg3C8iJ9b2g "This flow is used in legacy or highly controlled environments where secure alternatives aren't feasible. The client app directly collects and sends user credentials to ServiceNow to obtain an access token, making it suitable only for trusted internal use.")
* [Configure an OAuth resource owner password credential grant](https://servicenow-prod.fluidtopics.net/cNEdu5f5lkB_T2Wqn5Oi9Q "Configuring an OAuth resource owner password credential (ROPC) grant enables applications to authenticate users by directly using their credentials to obtain an access token. This method is ideal for trusted applications and legacy systems that require authentication without browser-based flows, enabling secure token validation and controlled API access.")