---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Service Token Flow

# Third party token workflow for service accounts {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 30. Juni 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Create a service account in ServiceNow® to represent the identity of a third-party application accessing APIs through a trusted identity provider (IdP). This account maps the token claims to a user record and manages access with roles and
permissions.

## Vorbereitungen

Role required: <kbd class="ph userinput">oauth_admin, mi_admin, admin</kbd>

## Warum und wann dieser Vorgang ausgeführt wird

When a third-party application authenticates using a token from an external identity provider (IdP), ServiceNow needs a corresponding user record to map the identity and apply access controls.

Create a corresponding `sys_user` account in ServiceNow for your service account. The value of the claim configured during the initial setup in the token issued by your Idp is mapped to the user field specified. This account represents the
service identity in ServiceNow. You can restrict this account to API access only, and assign the necessary permissions by adding the appropriate roles and groups.
Abbildung : 1. Service Account Workflow

## Prozedur

1. Follow the [Third party token workflow for user accounts](https://servicenow-prod.fluidtopics.net/Sak4GBQaLXTSKQqdU0fPWg "This workflow can be used to integrate third-party identity providers (IdPs) with ServiceNow for secure API access. It allows client applications to obtain tokens directly from an IdP and use them to access ServiceNow APIs.") to create a user account.
2. Create a `sys-user` account in ServiceNow to represent your service account identity.  
   Ensure that the token claim value matches with that of the value in the mapped user field (such as user_name or email) in the user record. Example: user_name, email.
   1. Select the Web service access only option to restrict the account to API access.
   2. Assign the required roles and groups to grant the appropriate permission.

   {#third-party-token-workflow-for-service-accounts__substeps_af1_tfv_vfc}  
   The ServiceNow platform maps the configured claim to the specified user field in the `sys_user` record. It enforces access based on that user's assigned roles and groups.
3. Make a GET request with the authorization header to the following endpoint:  

       Method: GET
       Endpoint: https:// <servicenow_base_url> /api/now/incident
       Authorization: Bearer YOUR_ACCESS_TOKEN