{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40401,"path":"platform-security/authentication/api-key-and-hmac-rest-apis.md","title":"API Key and HMAC Authentication for inbound REST APIs","bundle":null,"doc_type":null,"release":"australia","body":"\n# API Key and HMAC Authentication for inbound REST APIs\n\nSupport API tokens for REST API endpoints so that the ServiceNow® user name and password isn't visible in the webhook URL.\n\nEnable API key-based authentication to securely authenticate inbound webhook URL.\n\nTo use the API Key and HMAC Authentication, you must install the \\(Plugin: `com.glide.tokenbased_auth`\\) in the ServiceNow® instance.\n\n**Warning:** Use **POST** request when submitting any sensitive information to the server.\n\nInstalling API Key and HMAC Authentication has dependencies on the following plugins:\n\n-   REST API Auth Scope Plugin \\(`com.glide.rest.auth.scope`\\)\n-   REST API Access Policy Plugin \\(`com.glide.rest.policy`\\)\n-   Authentication scope \\(`com.glide.auth.scope`\\)\n\n## Benefits\n\nAPI Key and HMAC Authentication for inbound REST APIs enables:\n\n-   Ability to specify API key or HMAC token for REST API authentication.\n-   Ability to associate a user account with the API key or HMAC token.\n-   Ability to specify a token as query parameter or header within the REST API call.\n-   Ability to associate authentication scope with API key or HMAC token configurations so that API keys can only be used to invoke APIs associated with a particular scopes.\n-   Ability to associate an API key or HMAC token configuration with an authentication profile that can be used in API access policies.\n\n"}}