Configure API key - Token-based authentication
Configure an API key to support authentication for REST API endpoints.
Before you begin
Role required: api_service_admin, adaptive_auth_policy_admin
Plugin required: API Key and HMAC Authentication (com.glide.tokenbased_auth)
Procedure
-
Create an inbound authentication profile.
-
Navigate to All > System Web Services > API Access Policies > Inbound Authentication Profiles.
-
Select New.
The system displays the message
What kind of authentication profile? -
Select Create API Key authentication profiles.
[Omitted image "api-profile.png"] Alt text: API Key authentication profile
-
On the form, fill in the fields.
-
|
Field |
Description |
|---|---|
|
Name |
Name to identify the authentication policy. |
|
Application |
Scope of the authentication policy. |
|
Auth Parameter |
Select the auth parameter for the authentication request. You can select the default options or create a new auth parameter:- x-sn-apikey: Auth Header
|
\[Omitted image "api-parameter.png"\] Alt text: API Parameter
**Note:** To add a prefix for the API-Key, open the Auth Parameter file that you have selected and specify the **Prefix** field.
5. Submit the form.
-
Create a REST API key.
-
Navigate to All > System Web Services > API Access Policies > REST API Key.
-
Select New.
-
On the form, fill in the fields:
-
|
Field |
Description |
|---|---|
|
Name |
Name to identify the REST API Key |
|
Description |
Description for the REST API Key. |
|
Active |
Status of the REST API Key. |
|
User |
User associated to the REST API Key. Use the look-up icon to select the user. |
|
Auth Scope |
Option to add auth scope to manage the authority of the REST API Key. |
|
Token |
The REST API key generated by the ServiceNow AI Platform. Copy the key to use as part of the REST API call within the Header or Query parameter. |
|
Expiry |
Time after which the credential is no longer valid. Empty value means no expiration.Note: For more information, about expiry of token, see Cleaning up token expiry . |
5. Open the record that was created to view the token generated by the ServiceNow AI Platform for the user.
\[Omitted image "api-token.png"\] Alt text: API Token
-
Create a REST API Access policy.
-
Navigate to All > System Web Services > REST API Access Policies.
-
Select New.
-
On the form, fill in the fields.
-
|
Field |
Description |
|---|---|
|
Name |
Unique name of the API access policy. |
|
Active |
Option to make the API access policy active. |
|
REST API |
The REST API to which the access policy is applied. For example, Attachment API. |
|
REST API PATH |
API path of the REST API. This field is auto-populated based on the selected REST API. For example, now/attachment. |
|
HTTP Method |
Method used for interacting with the API. This field is auto-populated based on the selected REST API. |
|
Version |
Version of the API. For example, v1. This field is auto-populated based on the selected REST API.Note: To create an authentication policy for all versions of a REST API, you must create individual policies for each version. |
|
Resource |
Child resource of the REST API. This field is auto-populated based on the selected REST API. For example, /now/attachment |
|
Application |
Scope of the application. |
|
Global |
Enable this field to apply auth policy to all methods, versions, and resources for the API.Note: Token Based Auth isn’t allowed in the Global REST API Policy. |
|
Apply to all methods |
Enable this field to apply the auth policy for the API to all the methods, versions, and resources for the API. |
|
Apply to all resources |
Enable this field to apply the auth policy for the API to all the versions. |
|
Apply to all versions |
Enable this field to apply the auth policy for the API to all the resources. |
4. Add the API Authentication profile that was created.
5. Submit the form.
You can send the REST API call with the x-sn-apikey \(token\) that was generated by the ServiceNow AI Platform during the API Key creation within the Header or Query parameter based on the configuration for authentication.
**Warning:** Use **POST** request when submitting any sensitive information to the server.
---
title: Configure API key - Token-based authentication
description: Configure an API key to support authentication for REST API endpoints.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/configure-api-key.html
release: australia
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 3
breadcrumb: [API key and HMAC authentication for inbound REST APIs, Token-based authentication, API authentication, Authentication, Access Management]
---
# Configure API key - Token-based authentication
Configure an API key to support authentication for REST API endpoints.
## Before you begin
Role required: api\_service\_admin, adaptive\_auth\_policy\_admin
Plugin required: API Key and HMAC Authentication \(`com.glide.tokenbased_auth`\)
## Procedure
1. Create an inbound authentication profile.
1. Navigate to **All** > **System Web Services** > **API Access Policies** > **Inbound Authentication Profiles**.
2. Select **New**.
The system displays the message `What kind of authentication profile?`
3. Select **Create API Key authentication profiles**.
\[Omitted image "api-profile.png"\] Alt text: API Key authentication profile
4. On the form, fill in the fields.
<table id="table_pdg_vvm_nzb"><thead><tr><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td>
Name
</td><td>
Name to identify the authentication policy.
</td></tr><tr><td>
Application
</td><td>
Scope of the authentication policy.
</td></tr><tr><td>
Auth Parameter
</td><td>
Select the auth parameter for the authentication request. You can select the default options or create a new auth parameter:- x-sn-apikey: Auth Header
- x-sn-apikey: Query Parameter header
</td></tr></tbody>
</table> **Note:** The selected option has to be defined in the REST call in the Auth Header or Query Parameter.
\[Omitted image "api-parameter.png"\] Alt text: API Parameter
**Note:** To add a prefix for the API-Key, open the Auth Parameter file that you have selected and specify the **Prefix** field.
5. Submit the form.
2. Create a REST API key.
1. Navigate to **All** > **System Web Services** > **API Access Policies** > **REST API Key**.
2. Select **New**.
3. On the form, fill in the fields:
<table id="table_ehg_jtx_mzb"><thead><tr><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td>
Name
</td><td>
Name to identify the REST API Key
</td></tr><tr><td>
Description
</td><td>
Description for the REST API Key.
</td></tr><tr><td>
Active
</td><td>
Status of the REST API Key.
</td></tr><tr><td>
User
</td><td>
User associated to the REST API Key. Use the look-up icon to select the user.
</td></tr><tr><td>
Auth Scope
</td><td>
Option to add auth scope to manage the authority of the REST API Key.
</td></tr><tr><td>
Token
</td><td>
The REST API key generated by the ServiceNow AI Platform. Copy the key to use as part of the REST API call within the Header or Query parameter.
</td></tr><tr><td>
Expiry
</td><td>
Time after which the credential is no longer valid. Empty value means no expiration.**Note:** For more information, about expiry of token, see [Cleaning up token expiry](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/token-expiry-api-and-hmac.md) .
</td></tr></tbody>
</table> 4. Submit the form.
5. Open the record that was created to view the token generated by the ServiceNow AI Platform for the user.
\[Omitted image "api-token.png"\] Alt text: API Token
3. Create a REST API Access policy.
1. Navigate to **All** > **System Web Services** > **REST API Access Policies**.
2. Select **New**.
3. On the form, fill in the fields.
<table id="table_d4x_w45_d4b"><thead><tr><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td>
Name
</td><td>
Unique name of the API access policy.
</td></tr><tr><td>
Active
</td><td>
Option to make the API access policy active.
</td></tr><tr><td>
REST API
</td><td>
The REST API to which the access policy is applied. For example, **Attachment API**.
</td></tr><tr><td>
REST API PATH
</td><td>
API path of the REST API. This field is auto-populated based on the selected REST API. For example, **now/attachment**.
</td></tr><tr><td>
HTTP Method
</td><td>
Method used for interacting with the API. This field is auto-populated based on the selected REST API.
</td></tr><tr><td>
Version
</td><td>
Version of the API. For example, **v1**. This field is auto-populated based on the selected REST API.**Note:** To create an authentication policy for all versions of a REST API, you must create individual policies for each version.
</td></tr><tr><td>
Resource
</td><td>
Child resource of the REST API. This field is auto-populated based on the selected REST API. For example, **/now/attachment**
</td></tr><tr><td>
Application
</td><td>
Scope of the application.
</td></tr><tr><td>
Global
</td><td>
Enable this field to apply auth policy to all methods, versions, and resources for the API.**Note:** Token Based Auth isn’t allowed in the Global REST API Policy.
</td></tr><tr><td>
Apply to all methods
</td><td>
Enable this field to apply the auth policy for the API to all the methods, versions, and resources for the API.
</td></tr><tr><td>
Apply to all resources
</td><td>
Enable this field to apply the auth policy for the API to all the versions.
</td></tr><tr><td>
Apply to all versions
</td><td>
Enable this field to apply the auth policy for the API to all the resources.
</td></tr></tbody>
</table> \[Omitted image "add-api-key-policy.png"\] Alt text: Add profile to Access Policy
4. Add the API Authentication profile that was created.
5. Submit the form.
You can send the REST API call with the x-sn-apikey \(token\) that was generated by the ServiceNow AI Platform during the API Key creation within the Header or Query parameter based on the configuration for authentication.
**Warning:** Use **POST** request when submitting any sensitive information to the server.
| title | Configure API key - Token-based authentication |
| description | Configure an API key to support authentication for REST API endpoints. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/platform-security/authentication/configure-api-key.html |
| release | australia |
| product | Authentication |
| classification | authentication |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 3 |
| breadcrumb | API key and HMAC authentication for inbound REST APIsToken-based authenticationAPI authenticationAuthenticationAccess Management |