{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40667,"path":"platform-security/authentication/t_InstanceAsAuthorizationServer.md","title":null,"bundle":null,"doc_type":null,"release":null,"body":"---\ntitle: Authorization code flow example: ServiceNow instance as authorization server\ndescription: You can use an instance as an authorization server to issue tokens to a client using authorization code flow.\nlocale: en-US\ncanonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/t\\_InstanceAsAuthorizationServer.html\nrelease: australia\nproduct: Authentication\nclassification: authentication\ntopic_type: task\nlast_updated: \"2026-03-12\"\nreading_time_minutes: 2\nbreadcrumb: [OAuth authorization code grant flow, Old Inbound integrations experience, OAuth Inbound, OAuth authentication, Authentication, Access Management]\n---\n\n# Authorization code flow example: ServiceNow instance as authorization server\n\nYou can use an instance as an authorization server to issue tokens to a client using authorization code flow.\n\n## Before you begin\n\nRole required: none.\n\nThis example uses two instances: one as the authorization server and the other as the client. One instance uses a REST call to request tokens from another instance.\n\nYou must [Activate OAuth](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_ActivateOAuth.md) on both instances.\n\n## Procedure\n\n1.  On the authorization server instance \\(running the Istanbul or later release\\), navigate to **System OAuth** > **Application Registry** and then click **New**.\n\n2.  Click **Create an OAuth API endpoint for external clients**.\n\n3.  Fill out the form fields for the OAuth application record as described in [Create an endpoint for clients to access the instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_CreateEndpointforExternalClients.md).\n\n    Completing these steps sets up an authorization server. Follow the next steps to set up the client server.\n\n4.  On the client instance, navigate to **System OAuth** > **Application Registry** and then click **New**.\n\n5.  Click **Connect to a third party OAuth Provider**.\n\n6.  Fill out the form fields for the OAuth application record as described in .\n\n    Note the following field values:\n\n    -   **Name**: A unique name that identifies the application that you require OAuth access for.\n    -   **Client ID**: Client ID of the application registry record that you created for the authorization server.\n    -   **Client Secret**: \\[Read-Only\\] The auto-generated unique ID of the application. The instance uses the client ID when requesting an access token.\n    -   **Default Grant type**: Select **Authorization code**.\n    -   **Authorization URL**: URL of the instance that is the authorization server. Remember to append `oauth_auth.do` at the end of the URL.\n    -   **Logo URL**: The URL that contains an image to use as the application logo. The logo appears on the approval page when the user receives a request to grant a client application access to a restricted resource on the instance.\n    -   **Token URL**: URL of the instance that is the authorization server. Remember to append `oauth_token.do` at the end of the URL.\n    -   **Redirect URL**: URL of the instance: the client server instance. Remember to append `oauth_redirect.do` at the end of the URL.\n7.  Create a profile for the record with the **Authorization code** grant type.\n\n    The client server is setup. You can now create an outbound REST message and get an OAuth token.\n\n\n"}}