Configure the OAuth authentication method production instance

Export OAuth records from the development instance, import them into the production instance, and correct Key Management Framework (KMF) credential encryption. Configure development-to-production authentication so that both instances can validate their connections to each other.

About this task

After the development instance is validated, see Configure the OAuth authentication method development instance, the production instance must be able to communicate with development, and development must be able to communicate with production. This requires two rounds of record export and import; one in each direction with KMF credential correction performed after each import.

Important: When OAuth records are imported into a new instance, KMF re-encrypts password fields using the receiving instance's cryptographic key. The stored values appear jumbled and must be manually overwritten with the correct password before the connection can be validated.

Before you begin

Complete Configure the OAuth authentication method development instance on the development instance and confirm that the development connection validates successfully.
The integration user account must already exist on the production instance with the sn_se.scan_engine_admin and sn_se.internal_rest_integration roles assigned. See Create an integration user account.
Have the integration account password available in a text editor. You will paste it multiple times during this procedure.
Role required: Scan Engine Admin (sn_se.scan_engine_admin).

Procedure

Stage 1: Export OAuth records from the development instance
On the development instance, navigate to All > Scan Engine > My SN Instances and open the development instance record.
Select and hold (or right-click) the form header of the My SN Instances record and select Export > XML.
Save the file to a local folder (for example, SE_Data).
From the My SN Instances record, drill into the OAuth User Profile field, open the linked record, and export it as XML.
Navigate to All > System OAuth > Application Registry and filter the list to show only records scoped to Scan Engine.

[Omitted image "scan-engine-app-registry-filterout.png"] Alt text: Application registry filtering Scan Engine scope.

Two records should be present: OAuth Client Dev and OAuth Provider Dev.
Select both records and export them together as XML.
Open the OAuth Provider Dev record and locate the auto-generated OAuth entity profile record linked at the bottom of the form.

[Omitted image "scan-engine-oauthprovider-dev-profile.png"] Alt text: OAuth entity profile for OAuth Provider Dev.
Open the OAuth entity profile record and export it as XML.

You should now have four XML files in your export folder:
- MySN instance record
- OAuth user profile
- Two application registry records (OAuth Client Dev and OAuth Provider Dev)
- OAuth entity profile record
Stage 2: Prepare Key Management Framework access on the production instance
Grant KMF access to your setup user on the production instance, using Grant Key Management Framework access on an instance. Complete the steps in that task before you continue.
Stage 3: Import development records into the production instance
On the production instance, navigate to All > Scan Engine > My SN Instances.
Import the four XML files in the following order, using Import XML for each file:
1. OAuth entity profile record
2. Second OAuth entity profile record (if present)
3. MySN instance record
4. OAuth user profile (OAuth2 configuration) record
Stage 4: Correct KMF-encrypted credentials on the production instance
Navigate to sys_auth_profile_oauth2.list and open the Integration Account OAuth user profile record.
Switch the application scope to Scan Engine.
If the Username and Password fields are not visible, configure the form to display them, or open the record using the list layout.

When prompted whether to edit in Scan Engine or Global scope, select Global for the form configuration only.
Overwrite the Password field with the integration account password from your text editor and select Save.

Importing the record causes KMF to re-encrypt the password field with the production instance key. Overwriting it restores the correct value.
Navigate to All > System OAuth > Application Registry and open OAuth Client Dev.
Unlock the Client Secret field, overwrite it with the integration account password, and select Save.
Return to the Application Registry list and open OAuth Provider Dev.
Unlock the Client Secret field, overwrite it with the integration account password, and select Save.
Stage 5: Grant KMF module access and validate the development connection
Complete the KMF module access policy steps in Grant Key Management Framework access on an instance, including the step that sets the Scan Engine script include to Track.
Navigate to All > Scan Engine > My SN Instances, remove any active filters, and open the development instance record.
Select Validate Connection.

Connection Status updates to Connection Valid. The production instance can now communicate with the development instance. See Validate your instance connection for additional information.
Stage 6: Create the OAuth client and provider for the production instance
Confirm the application scope is set to Scan Engine.

Navigate to All > Scan Engine > My SN Instances and confirm that a My SN Instances record exists for the production instance.

If the production instance record has not been created yet, complete Register your instance before continuing as follows. The record must exist before OAuth fields can be configured.

Field	Value
Instance Name	The instance name as it appears in `stats.do` for the production instance.
Instance URL	The full URL of the production instance. Select the lock icon next to the field to enter the URL.
Environment	Production

Navigate to All > System OAuth > Inbound Integrations and select New Integration.

Select Resource Owner Password Credential Grant and complete the fields in the following table.

Field	Value
Name	OAuth Client Prod
Provider Name	Leave empty.
Client ID	Copy the auto-generated value to your text editor for use in the next step.
Client Secret	Enter the integration account password.
Auth Scope	useraccount
Advanced options: Token Format	Opaque

Select Save.
Navigate to All > System OAuth > Application Registry and select New.

Select Connect to an OAuth Provider (simplified) — Outbound and complete the fields in the following table.

Field	Value
Name	OAuth Provider Prod
Client ID	Paste the client ID copied from OAuth Client Prod.
Client Secret	Enter the integration account password.
Default Grant Type	Resource Owner Password Credentials
Redirect URL	Select the redirect URL for the production instance. Example: https://instancename.service-now.com/oauth_redirect.do
Token URL	Use the redirect URL with the path changed to `oauth_token.do`. Example: https://instancename.service-now.com/oauth_token.do

Select Save.

An OAuth entity profile record is automatically generated and appears at the bottom of the form. Leave this record as-is.
Stage 7: Link OAuth records to the production MySN instance and validate
Navigate to All > Scan Engine > My SN Instances and open the production instance record created in Register your instance.

Complete the fields in the following table.

Field	Value
Authentication Type	OAuth
OAuth Application Registry	OAuth Provider Prod
OAuth User Profile	Select the existing Integration Account profile (the same profile used for the development connection).

Select Save, then select Validate Connection.

Note: Because the KMF module access policy for the ScanEngineApiUtil script include was already set to Track in Stage 5, the connection should validate immediately without additional KMF steps. See Validate your instance connection for additional information.

Connection Status updates to Connection Valid.
Stage 8: Export production records and import into the development instance
From the production instance, navigate to All > System OAuth > Application Registry and export the following records as XML:
- OAuth Client Prod
- OAuth Provider Prod
- The OAuth entity profile auto-generated by OAuth Provider Prod
Export the production My SN Instances record as XML.
Log in to the development instance and navigate to All > Scan Engine > My SN Instances.
Import the four XML files using Import XML.
Navigate to All > System OAuth > Application Registry and correct the KMF-encrypted client secret on both OAuth Client Prod and OAuth Provider Prod by overwriting each with the integration account password.

See Stage 4 for the correction procedure.
Navigate to All > Scan Engine > My SN Instances, remove any active filters, and open the production instance record.
Select Validate Connection.

Connection Status updates to Connection Valid. Both instances now have valid My SN Instances records for development and production.

Result

Both the development and production instances have validated My SN Instances records in each direction. Definition synchronization, update set summary synchronization, and exception reason synchronization are now available.

What to do next

Parent Topic:Configure the OAuth authentication method development instance

title	Configure the OAuth authentication method production instance
description	Export OAuth records from the development instance, import them into the production instance, and correct Key Management Framework \(KMF\) credential encryption. Configure development-to-production authentication so that both instances can validate their connections to each other.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/impact/configure-oauth-auth-method-prod.html
release	brazil
topic_type	task
last_updated	2026-10-27
reading_time_minutes	8
breadcrumb	Configure the OAuth authentication method development instanceRegister your instanceScan Engine integrationsActivate Scan Engine and review settingsConfiguring ImpactImpact