---
sourceDocument: Australia Impact
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/impact

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Impact

ft:clusterId :

    - ipact

bundleId :

    - ipact


---

# Configure the OAuth authentication method production instance

# Configure the OAuth authentication method production instance {#ariaid-title1}

* Release version: Australia
* 
* Updated May 29, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read

Export OAuth records from the development instance, import them into the production instance, correct Key Management Framework (KMF) credential encryption, and configure development-to-production authentication so that both
instances can validate their connections to each other.

## About this task

After the development instance is validated, see [Configure the OAuth authentication method development instance](https://servicenow-prod.fluidtopics.net/1yaYVDnxfcmFLl6Jpf0k0A "Set up OAuth authentication for instance-to-instance Scan Engine integrations using several stages, an integration user account, an OAuth2 configuration record, and provider and client application registries."), the production instance must be able to communicate with development, and development must be able to communicate with production. This requires two rounds of record export and
import; one in each direction with KMF credential correction performed after each import.  
Important:  
When OAuth records are imported into a new instance, KMF re-encrypts password fields using the receiving instance's cryptographic key. The stored values will appear jumbled and must be manually overwritten with the correct password before the connection can be validated.

## Before you begin

* Complete [Configure the OAuth authentication method development instance](https://servicenow-prod.fluidtopics.net/1yaYVDnxfcmFLl6Jpf0k0A "Set up OAuth authentication for instance-to-instance Scan Engine integrations using several stages, an integration user account, an OAuth2 configuration record, and provider and client application registries.") on the development instance and confirm that the development connection validates successfully.
* The integration user account must already exist on the production instance with the `sn_se.scan_engine_admin` and `sn_se.internal_rest_integration` roles assigned. See [Create an integration user account](https://servicenow-prod.fluidtopics.net/R8zhF4x0HSwyhYcCi965FA "Create a dedicated integration user account and assign the required roles so that the Scan Engine can authenticate and communicate between your ServiceNow instances.").
* Have the integration account password available in a text editor. You will paste it multiple times during this procedure.
* Role required: Scan Engine Admin (`sn_se.scan_engine_admin`).

## Procedure

Stage 1 --- Export OAuth records from the development instance

1. On the development instance, navigate to AllScan EngineMy SN Instances and open the development instance record.
2. Select and hold (or right-click) the form header of the MySN instance record and select Export \> XML.
3. Save the file to a local folder (for example, SE_Data).
4. From the MySN instance record, drill into the OAuth User Profile field, open the linked record, and export it as XML.
5. Navigate to AllSystem OAuthApplication Registry and filter the list to show only records scoped to Scan Engine.  
   Two records should be present: <kbd class="ph userinput">OAuth Client Dev</kbd> and <kbd class="ph userinput">OAuth Provider Dev</kbd>.
6. Select both records and export them together as XML.
7. Open the OAuth Provider Dev record and locate the auto-generated OAuth entity profile record linked at the bottom of the form.  
8. Open the OAuth entity profile record and export it as XML.  
   You should now have four XML files in your export folder:
   * MySN instance record
   * OAuth user profile
   * Two application registry records (OAuth Client Dev and OAuth Provider Dev)
   * OAuth entity profile record
   {#configure-oauth-auth-method-prod__ul_nty_vjm_kjc}

Stage 2 --- Prepare Key Management Framework access on the production instance

9. Log in to the production instance.
10. In the Navigator, type <kbd class="ph userinput">key</kbd> and open Key Management Administration.
11. Add your user account to the selected users list and save.  
    The role `sn_kmf.admin` is automatically assigned to your account.
12. Log out and log back in, then navigate to your user record.
13. In the Roles related list, select Edit and also assign `sn_kmf.cryptographic_manager`.
14. Log out and log back in to activate both KMF roles.

Stage 3 --- Import development records into the production instance

15. On the production instance, navigate to AllScan EngineMy SN Instances.
16. Import the four XML files in the following order, using Import XML for each file:  
    1. OAuth entity profile record
    2. Second OAuth entity profile record (if present)
    3. MySN instance record
    4. OAuth user profile (OAuth2 configuration) record

Stage 4 --- Correct KMF-encrypted credentials on the production instance

17. Navigate to `sys_auth_profile_oauth2.list` and open the Integration Account OAuth user profile record.
18. Switch the application scope to Scan Engine.
19. If the Username and Password fields are not visible, configure the form to display them, or open the record using the list layout.  
    When prompted whether to edit in Scan Engine or Global scope, select Global for the form configuration only.
20. Overwrite the Password field with the integration account password from your text editor and select Save.  
    Importing the record causes KMF to re-encrypt the password field with the production instance key. Overwriting it restores the correct value.
21. Navigate to AllSystem OAuthApplication Registry and open OAuth Client Dev.
22. Unlock the Client Secret field, overwrite it with the integration account password, and select Save.
23. Return to the Application Registry list and open OAuth Provider Dev.
24. Unlock the Client Secret field, overwrite it with the integration account password, and select Save.

Stage 5 --- Grant KMF module access and validate the development connection

25. In the Navigator, type <kbd class="ph userinput">key</kbd>.
26. Navigate to AllKey Management FrameworkModule Access PoliciesAll.
27. Filter the Script table column to show Script Includes only and locate the record named ScanEngine API Util.
28. Open the record, change the access decision to Track, and select Save.
29. Navigate to AllScan EngineMy SN Instances, remove any active filters, and open the development instance record.
30. Select Validate Connection.  
    Connection Status updates to Connection valid. The production instance can now communicate with the development instance. See [Validate your instance connection](https://servicenow-prod.fluidtopics.net/HA6MFEOw7zePlehyV0xnCQ "Validate the connection between registered instances to confirm that authentication and My SN Instances configuration are correct before enabling integrations.") for additional information.

Stage 6 --- Create the OAuth client and provider for the production instance

31. Confirm the application scope is set to Scan Engine.
32. Navigate to AllScan EngineMy SN Instances and confirm that a MySN instance record exists for the production instance.  
    If the production instance record has not been created yet, complete [Register your instance](https://servicenow-prod.fluidtopics.net/CW_9LTbn1YISzXh4d4sYSg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.") before continuing as follows. The record must exist before OAuth fields can be configured.{#configure-oauth-auth-method-prod__entry__2}

    | Field | Value |
    |-|-|
    | Instance Name | The instance name as it appears in `stats.do` for the production instance. |
    | URL | The full URL of the production instance. |
    | Environment | Production |
    [ ]

33. Navigate to AllSystem OAuthInbound Integrations and select New Integration.
34. Select Resource Owner Password Credential Grant and fill out the form as follows:  
    {#configure-oauth-auth-method-prod__entry__10}

    | Field | Value |
    |-|-|
    | Name | OAuth Client Prod |
    | Provider Name | Leave empty. |
    | Client ID | Copy the auto-generated value to your text editor for use in the next step. |
    | Client Secret | Enter the integration account password. |
    | Auth Scope | useraccount |
    | Advanced options: Token Format | Opaque |
    [ ]

35. Select Save.
36. Navigate to AllSystem OAuthApplication Registry and select New.
37. Select Connect to an OAuth Provider (simplified) --- Outbound and fill out the form as follows:  
    {#configure-oauth-auth-method-prod__entry__24}

    | Field | Value |
    |-|-|
    | Name | OAuth Provider Prod |
    | Client ID | Paste the client ID copied from OAuth Client Prod. |
    | Client Secret | Enter the integration account password. |
    | Default Grant Type | Resource Owner Password Credentials |
    | Redirect URL | Select the redirect URL for the production instance. Example: https://prod.servicenow.com/oauth_redirect.do |
    | Token URL | Use the redirect URL with the path changed to `oauth_token.do`. Example: https://prod.servicenow.com/oauth_token.do |
    [ ]

38. Select Save.  
    An OAuth entity profile record is automatically generated and appears at the bottom of the form. Leave this record as-is.

Stage 7 --- Link OAuth records to the production MySN instance and validate

39. Navigate to AllScan EngineMy SN Instances and open the production instance record created in [Register your instance](https://servicenow-prod.fluidtopics.net/CW_9LTbn1YISzXh4d4sYSg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.").
40. Configure the record as follows:  
    {#configure-oauth-auth-method-prod__entry__38}

    | Field | Value |
    |-|-|
    | Authentication Type | OAuth |
    | OAuth Application Registry | OAuth Provider Prod |
    | OAuth User Profile | Select the existing Integration Account profile (the same profile used for the development connection). |
    [ ]

41. Select Save, then click Validate Connection.  
    Note:  
    Because the KMF module access policy for ScanEngine API Util was already set to Track in Stage 5, the connection should validate immediately without additional KMF steps. See [Validate your instance connection](https://servicenow-prod.fluidtopics.net/HA6MFEOw7zePlehyV0xnCQ "Validate the connection between registered instances to confirm that authentication and My SN Instances configuration are correct before enabling integrations.") for additional information.  
    Connection Status updates to Connection valid.

Stage 8 --- Export production records and import into the development instance

42. From the production instance, navigate to AllSystem OAuthApplication Registry and export the following records as XML:  
    * OAuth Client Prod
    * OAuth Provider Prod
    * The OAuth entity profile auto-generated by OAuth Provider Prod
43. Export the production MySN instance record as XML.
44. Log in to the development instance and navigate to AllScan EngineMy SN Instances.
45. Import the four XML files using Import XML.
46. Navigate to AllSystem OAuthApplication Registry and correct the KMF-encrypted client secret on both OAuth Client Prod and OAuth Provider Prod by overwriting each with the integration account password.  
    See Stage 4 for the correction procedure.
47. Navigate to AllScan EngineMy SN Instances, remove any active filters, and open the production instance record.
48. Select Validate Connection.  
    Connection Status updates to Connection valid. Both instances now have valid MySN instance records for development and production.

## Result

Both the development and production instances have validated MySN instance records
in each direction. Definition synchronization, update set summary synchronization,
and exception reason synchronization are now available.

## What to do next

* [Definitions integration](https://servicenow-prod.fluidtopics.net/bAcDwKsN6iMuxOZNtvqA2w "The Definitions integration synchronizes new, customized, and overridden definitions between non-production and production instances.")
* [Exception reason integration](https://servicenow-prod.fluidtopics.net/dN1GbIsAmXO8sZdZ99xsaQ "You can synchronize exception reasons from non-production to Production instances once a record is created or updated.")
* [User story integration](https://servicenow-prod.fluidtopics.net/T~iXBVrufCLPeug3LcR2TA "The User story integration creates agile tasks and stories directly from Scan Engine finding records in ServiceNow, Jira, Azure DevOps, or any external system.")
* [Deployment and synchronization integrations](https://servicenow-prod.fluidtopics.net/DH4BirffxVjbc2GskQG8Wg "The AES/AEMC and Update set integrations control how custom app deployments are governed and how scan results are synchronized across your instance stack.")
{#configure-oauth-auth-method-prod__ul_zc3_szf_kjc}

*[\>]: and then