---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Web Embeddables

# Web Embeddables {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Secure the web embeddables feature for authenticating the ServiceNow's web components that are used in third-party portals.

The web embeddables capability enables you to embed the ServiceNow web components into external websites outside ServiceNow. You can use these web components to interact with the ServiceNow using dedicated APIs that allow for real-time data exchange and functionality use without requiring users to directly access the ServiceNow interface.

While using the web embeddables, it is important to authenticate to the ServiceNow web components securely and restrict or remove high privilege roles to the users. During authentication an embedded session is established to display information from ServiceNow within the web components.

The (<kbd class="ph userinput">/now/client/authenticate</kbd>) API end point is used for authenticating the request from a third-party to establish the embedded session of ServiceNow.  
Hinweis:  
You must use a dedicated <kbd class="ph userinput">Custom URL</kbd> to authenticate the request from a third-party.

To use this end point, you need to send a valid bearer auth JWT based token in the authorization header as part of authentication request. When a valid token is sent, the session is considered as embedded with the removal of
<kbd class="ph userinput">admin</kbd> and <kbd class="ph userinput">security admin</kbd> roles to the user.

Further, you can perform role relegation to further configure the roles that are required to be removed during an embedded session. To learn more about embedded session role configuration, see [Configure client session access role](https://servicenow-prod.fluidtopics.net/juuHmULsrCVZsfB6xDkeBg "The Embedded Session Role Configuration (Client Access Role configuration) record is created by default, which included removal of admin and security admin roles (high privilege roles) for the users using the UI components on the third-party portals.").

To know more about the configuration of web embeddables, see [Configure Web Embeddables](https://www.servicenow.com/docs/access?context=using-web-embeddables&version=australia&pubname=australia-customer-service-management&ft:locale=en-US).

By default, the policy can be configured with only Embedded Session filter criteria. You can leverage Zero Trust Access (ZTA) plugin to further enhance its usage with filters such as IP,
Location, Role, Group, Identity Provider Attributes. You can add these filters to the policies created in the Client Access Role Configuration table. This ensures further strengthening the access complexity and
have a better security posture while establishing an embedded session. For more information about ZTA, see [Zero Trust Access (ZTA)](https://servicenow-prod.fluidtopics.net/NxCt_r6~52TWhm29xo89mQ "Zero Trust Access (ZTA) is a security model that assumes that no user or device is trusted by default.").  
Hinweis:  
* Embedded client access (<kbd class="ph userinput">com.glide.security.client_access</kbd>) plugin is used for including capabilities such as role relegation for Web Embeddables feature. This plugin is auto-installed when the Web Embeddable plugin is installed.
* You must set glide.uxf.lib.embeddables.enabled property to <kbd class="ph userinput">true</kbd> for using the (<kbd class="ph userinput">/now/client/authenticate</kbd>) end point.
{#web-embeddables__ul_nnc_5xp_tbc}

You can also implement these additional security measures to further have a stronger control over the privileges of the user when using the web components:

* Configure the client type to Embedded for the corresponding OIDC (OAuth Entity) record. To set the client type as Embedded, you must install Zero Trust Access (ZTA) plugin.
* Use the IsEmbeddedSession as a security attribute for the access controls (ACLs). The IsEmbeddedSession security attribute is added when installing the Embedded client access (<kbd class="ph userinput">com.glide.security.client_access</kbd>) plugin. For more information, see [OOB (Out-of-Box) Security Attributes](https://servicenow-prod.fluidtopics.net/ksQAz3pm09WvDobx4MLf4A "Commonly used, generalized Security Attributes roles ready for use.").
{#web-embeddables__ul_ql4_bk2_5bc}