{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40468,"path":"platform-security/authentication/configure-api-key.md","title":"Configure API key - Token-based authentication","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure API key - Token-based authentication\n\nConfigure an API key to support authentication for REST API endpoints.\n\n## Before you begin\n\nRole required: api\\_service\\_admin, adaptive\\_auth\\_policy\\_admin\n\nPlugin required: API Key and HMAC Authentication \\(`com.glide.tokenbased_auth`\\)\n\n## Procedure\n\n1. Create an inbound authentication profile.\n\n 1. Navigate to **All** > **System Web Services** > **API Access Policies** > **Inbound Authentication Profiles**.\n\n 2. Select **New**.\n\n The system displays the message `What kind of authentication profile?`\n\n 3. Select **Create API Key authentication profiles**.\n\n \\[Omitted image \"api-profile.png\"\\] Alt text: API Key authentication profile\n\n 4. On the form, fill in the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName to identify the authentication policy.\n\n
\n\nApplication\n\n\n\nScope of the authentication policy.\n\n
\n\nAuth Parameter\n\n\n\nSelect the auth parameter for the authentication request. You can select the default options or create a new auth parameter:- x-sn-apikey: Auth Header\n- x-sn-apikey: Query Parameter header\n\n\n
**Note:** The selected option has to be defined in the REST call in the Auth Header or Query Parameter.\n\n \\[Omitted image \"api-parameter.png\"\\] Alt text: API Parameter\n\n **Note:** If you wish to add a prefix for the API-Key, Open the Auth Parameter file that you have selected and specify the **Prefix** field.\n\n 5. Submit the form.\n\n2. Create a REST API key.\n\n 1. Navigate to **All** > **System Web Services** > **API Access Policies** > **REST API Key**.\n\n 2. Select **New**.\n\n 3. On the form, fill the fields:\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName to identify the REST API Key\n\n
\n\nDescription\n\n\n\nDescription for the REST API Key.\n\n
\n\nActive\n\n\n\nStatus of the REST API Key.\n\n
\n\nUser\n\n\n\nUser associated to the REST API Key. Use the look-up icon to select the user.\n\n
\n\nAuth Scope\n\n\n\nOption to add auth scope to manage the authority of the REST API Key.\n\n
\n\nToken\n\n\n\nThe REST API key generated by the ServiceNow AI Platform. Copy the key to use as part of the REST API call within the Header or Query parameter.\n\n
\n\nExpiry\n\n\n\nTime after which the credential is no longer valid. Empty value means no expiration.**Note:** For more information, about expiry of token, see [Cleaning up token Expiry](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/token-expiry-api-and-hmac.md) .\n\n
4. Submit the form.\n\n 5. Open the record that was created to view the token generated by the ServiceNow AI Platform for the user.\n\n \\[Omitted image \"api-token.png\"\\] Alt text: API Token\n\n3. Create a REST API Access policy.\n\n 1. Navigate to **All** > **System Web Services** > **REST API Access Policies**.\n\n 2. Select **New**.\n\n 3. On the form, fill in the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nUnique name of the API access policy.\n\n
\n\nActive\n\n\n\nOption to make the API access policy active.\n\n
\n\nREST API\n\n\n\nThe REST API to which the access policy is applied. For example, **Attachment API**.\n\n
\n\nREST API PATH\n\n\n\nAPI path of the REST API. This field is auto-populated based on the selected REST API. For example, **now/attachment**.\n\n
\n\nHTTP Method\n\n\n\nMethod used for interacting with the API. This field is auto-populated based on the selected REST API.\n\n
\n\nVersion\n\n\n\nVersion of the API. For example, **v1**. This field is auto-populated based on the selected REST API.**Note:** If you want to create an authentication policy for all versions of a REST API, you must create individual policies for each version.\n\n
\n\nResource\n\n\n\nChild resource of the REST API. This field is auto-populated based on the selected REST API. For example, **/now/attachment**\n\n
\n\nApplication\n\n\n\nScope of the application.\n\n
\n\nGlobal\n\n\n\nEnable this field to apply auth policy to all methods, versions, and resources for the API.**Note:** Token Based Auth isn’t allowed in the Global REST API Policy.\n\n
\n\nApply to all methods\n\n\n\nEnable this field to apply the auth policy for the API to all the methods, versions, and resources for the API.\n\n
\n\nApply to all resources\n\n\n\nEnable this field to apply the auth policy for the API to all the versions.\n\n
\n\nApply to all versions\n\n\n\nEnable this field to apply the auth policy for the API to all the resources.\n\n
\\[Omitted image \"add-api-key-policy.png\"\\] Alt text: Add profile to Access Policy\n\n 4. Add the API Authentication profile that was created.\n\n 5. Submit the form.\n\n You can send the REST API call with the x-sn-apikey \\(token\\) that was generated by the ServiceNow AI Platform during the API Key creation within the Header or Query parameter based on the configuration for authentication.\n\n **Warning:** Use **POST** request when submitting any sensitive information to the server.\n\n\n"}}