{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40655,"path":"platform-security/authentication/t_CreateEndpointforExternalClients.md","title":"Create an endpoint for clients to access the instance","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create an endpoint for clients to access the instance\n\nCreate an OAuth application endpoint for external client applications to access the ServiceNow instance.\n\n## Before you begin\n\nRole required: oauth\\_admin\n\n## Procedure\n\n1. Navigate to **All** > **System OAuth** > **Application Registry** and then click **New**.\n\n2. On the interceptor page, click **Create an OAuth API endpoint for external clients** and then fill in the form.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nA unique name that identifies the application that you require OAuth access for.\n\n
\n\nClient ID\n\n\n\n\\[Read-Only\\] The auto-generated unique ID of the application. The instance uses the client ID when requesting an access token.\n\n
\n\nClient Secret\n\n\n\n\\[Required\\] The shared secret string that both the instance and the client application or website use to authorize communications with one another. The instance uses the client secret when requesting an access token. Leave this field blank to have the instance auto-generate a client secret. To display existing client secrets, click the lock icon.\n\n
\n\nRedirect URL\n\n\n\nThe callback URL that the authorization server redirects to. Enter the full URLs of the clients requesting access to the resource, appended by `/oauth_redirect.do`. For example, `http://token_consumer:port/oauth_redirect.do`. Enter as many URLs as needed for all possible token consumers. The instance matches the URL of the incoming request to one of the redirect URLs. If no match is made, the instance uses the first redirect URL.\n\n
\n\nLogo URL\n\n\n\nThe URL that contains an image to use as the application logo. The logo appears on the approval page when the user receives a request to grant a client application access to a restricted resource on the instance.\n\n
\n\nActive\n\n\n\nSelect the check box to make the application registry active.\n\n
\n\nRefresh Token Lifespan\n\n\n\nThe number of seconds that a refresh token is valid. The instance uses the lifespan value when requesting a refresh token. By default, refresh tokens expire in 100 days \\(8640000 seconds\\).\n\n
\n\nEnforce Token Restrictions\n\n\n\nSelect to only allow tokens to be used with APIs set to allow the authentication profile. You can set grant access using an API access policy. For more information, see [Create REST API access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/create-api-access-policy.md).Default: Unselected.\n\n
\n\nMobile Client\n\n\n\nRepresents the entity for mobile app or web. This information is used to analyze the login information with mobile or web.\n\n
\n\nAccess Token Lifespan\n\n\n\nThe number of seconds that an access token is valid. The instance uses the lifespan value when requesting an access token. By default, access tokens expire in 30 minutes \\(1800 seconds\\).\n\n
\n\nToken Format\n\n\n\nFormat of the token to generate. The format determines the structure of a token and the information it includes.\n\n
\n\nSubject Claim\n\n\n\nField in the User \\(sys\\_user\\) table that's used to populate the value of the subject \\(sub\\) claim of a JWT token. The sub claim is a piece of information that identifies the subject, or user, of the JWT token. This field only applies if the **Token Format** is JWT.\n\n
\n\nComments\n\n\n\nAdditional information to associate with the application.\n\n
\n\nClient Type\n\n\n\nChoose the client type, based on the type of your client. Options:- **Iframe Embedded**\n- **Integration as a User**\n- **Integration as a Service**\nTo know more, see [Configure client type for OAuth and SSO records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/client-type.md).\n\n
3. Click **Submit**.\n\n\n## Result\n\nThe system creates a record in the Application Registries \\[oauth\\_entity\\] table with of type OAuth Client. When the instance actually issues tokens and authorization codes, they are stored in the table. See [Manage OAuth tokens](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_ManageTokens.md) for more information.\n\n"}}