{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":50930,"path":"source-to-pay-operations/supplyon-configure-inbound-auth.md","title":"Configure inbound authentication for the async callback","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure inbound authentication for the async callback\n\nSet up the API-key authentication profile, access policy, role, and service account that secure the async callback endpoint.\n\n## Before you begin\n\nRole required: admin\n\n## About this task\n\nThe async callback endpoint requires authentication. An API-key inbound authentication profile secures it, bound to the endpoint through a REST API Access Policy. A role gates access further — the calling account must hold that role. There is no shared-secret header.\n\nThe authentication chain is as follows:\n\n1.  API key in the x-sn-apikey header: SupplyOn presents its API key in the `x-sn-apikey` header \\(the default ServiceNow API-key header\\). This credential identifies the caller.\n2.  API-key authentication profile: An inbound authentication profile of type HTTP Authentication Profile Using API Key \\(named SupplyOn, in scope `sn_supplyon_po`\\) reads the key from `x-sn-apikey`. It then resolves the key to the user that the key belongs to.\n3.  REST API Access Policy binds the profile to the endpoint: A REST API Access Policy targets the callback flow API \\(api\\_path `sn_supplyon_po/supplyon_outbound_po_async_callback`\\) and maps it to the SupplyOn API-key profile. The flow security scheme requires authentication and enables external access.\n4.  Endpoint ACL requires the integration-user role: An endpoint ACL requires the `sn_supplyon_po.integration_user` role, so the user that the API key resolves to must also carry this role to invoke the endpoint.\n5.  Role is assigned to a dedicated service account: `sn_supplyon_po.integration_user` is assigned only to the dedicated SupplyOn integration service account, never to a human account.\n\nThe authentication profile, access policy, security scheme, ACL, and role ship with the application. The API key value is runtime data issued to the service account and must not be committed to source.\n\n## Procedure\n\n1.  Confirm the dedicated integration service account exists and holds the sn\\_supplyon\\_po.integration\\_user role.\n\n2.  In the API Keys module, create an API key attached to the service account, and record its value.\n\n3.  Confirm that SupplyOn sends the key in the `x-sn-apikey` header.\n\n4.  Provide the endpoint URL and issued key to SupplyOn for portal registration.\n\n\n## What to do next\n\n**Note:**\n\n-   The integration\\_user role also includes the procurement integrator role, which is required to create the inbound purchase order confirmation records.\n-   The callback subflow runs as system for the staging writes, so the integration-user role is the authentication boundary between SupplyOn and ServiceNow and is kept deliberately narrow.\n\n"}}