Cleaning up token expiry

concept australia Updated Sep 10, 2026 1 min read token-expiry-api-and-hmac.md

Details about how to clean up token expiry by using different system properties.

After the API Key or HMAC secret expires, the details are retained for 7 days. A scheduled job Clean expired Token Auth Credentials deletes the expired API keys or HMAC secrets after that. You can configure this behavior and control the deletion using the following properties:

com.snc.platform.security.token.auth.cleanup: Use this property if you want to delete expired API keys and HMAC tokens. By default true.
com.snc.platfrom.security.token.auth.days.expired.api_key.is.kept: Set the value based on your requirement to determine the number of days you want to keep the expired API token in the system. By default 7.
com.snc.platfrom.security.token.auth.days.expired.hmac_key.is.kept: Set the value based on your requirement to determine the number of days you want to keep the expired HMAC token in the system. By default 7.

To navigate to the token expiry property, enter sys_properties.list in the navigation bar and then search for the following properties. Change the expiry based on your requirement.

27 lines · 1.7 KB Wrap lines

---
title: Cleaning up token expiry
description: Details about how to clean up token expiry by using different system properties.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/token-expiry-api-and-hmac.html
release: australia
product: Authentication
classification: authentication
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [API key and HMAC authentication for inbound REST APIs, Token-based authentication, API authentication, Authentication, Access Management]
---

# Cleaning up token expiry

Details about how to clean up token expiry by using different system properties.

After the API Key or HMAC secret expires, the details are retained for 7 days. A scheduled job `Clean expired Token Auth Credentials` deletes the expired API keys or HMAC secrets after that. You can configure this behavior and control the deletion using the following properties:

- **com.snc.platform.security.token.auth.cleanup**: Use this property if you want to delete expired API keys and HMAC tokens. By default `true`.
- **com.snc.platfrom.security.token.auth.days.expired.api\_key.is.kept**: Set the value based on your requirement to determine the number of days you want to keep the expired `API` token in the system. By default 7.
- **com.snc.platfrom.security.token.auth.days.expired.hmac\_key.is.kept**: Set the value based on your requirement to determine the number of days you want to keep the expired `HMAC` token in the system. By default 7.

To navigate to the token expiry property, enter `sys_properties.list` in the navigation bar and then search for the following properties. Change the expiry based on your requirement.