Defining ServiceNow Instances

ℹ️ Security Update: Certificate Authentication Setup

Last Updated: March 2, 2026 – 11:50 CET

We have updated our certificate-based authentication setup for ServiceNow. Quality Clouds now implements a dedicated Private CA architecture to ensure long-term connectivity resilience.

This transition allows us to bypass the new 199-day expiration mandates for public browser certificates, ensuring a more stable integration with significantly less frequent maintenance requirements for your team.

Prerequisites #

Before performing these steps, make sure you have the following information:

 

Setting up your instances #

To scan your instances, Quality Clouds must be connected to them.
You can connect your instance using one of the following authentication methods:

  • Cert-Based Authentication
  • Basic Authentication
  • OAuth protocol

 

Add a ServiceNow Instance in Quality Clouds #

  1. Log in to the Quality Clouds Admin Portal at
    https://portal.qualityclouds.com

  2. Go to Account.

  3. Navigate to the Instances section.

  4. Select the ServiceNow tab
    (only required if you manage multiple SaaS platforms in Quality Clouds).

  5. Click + Add.

  6. Add ServiceNow URL and Description: If your instance uses SSO or another external authentication method, ensure the account has local authentication enabled in ServiceNow (not dependent on external providers) and REST API access.

  7. Choose BASIC, CERTIFICATE or OAUTH authentication (see details below for each method)

  8. Environment: The environment type of the instance. This is used to provide additional context.
    Note: ServiceNow Production (PROD) instances are subject to an additional check to verify that debugging properties are not enabled.

  9. Go-live Date: The date when the instance was first activated. This serves as a baseline for tracking changes.

  10. Tags: Optional labels to help identify and organize instances more easily.

  11. Save

 

Certificate-Based Authentication

#

What is Certificate-based authentication? #

Certificate-based authentication verifies user logins or API requests using trusted certificates issued by a Certificate Authority (CA). This authentication method can be used to authenticate requests to ServiceNow SOAP and REST APIs. Since the interaction between Quality Clouds and ServiceNow instances is implemented via the REST API, it is possible to support Certificate Based authentication for this interaction, as an alternative to the Basic authentication mechanism.

Why use a certification-based authentication? #

To provide enhanced security in the connection between Quality Clouds and your ServiceNow instance.

How to Configure it?

 #

Step 1: Verify Instance Support

Verify that your ServiceNow instance supports certificate-based authentication:

  • Append /adcv2/supports_tls to your instance URL and open it in a browser.

  • If the response is True, your instance supports it.

  • If you receive a 402 error, contact ServiceNow support and request enabling ADCv2 and ADC-to-APP mTLS.

 

Step 2: Download Quality Clouds Certificates

Download the public certificate from Quality Clouds as follows:

 

NOTE: When rotating certificates, do not delete the old certificate immediately. Please keep both the old and new certificates active in your instance until Quality Clouds completes the backend switch, to prevent any temporary loss of connectivity.

 

Step 3: Install the CA Certificate in ServiceNow

Install the Quality Clouds CA certificate in your ServiceNow instance:

  • Navigate to All → CA Certificate Chain → New

  • Complete all required fields

  • Upload QC Authority 2026

  • Submit and Wait for Validation

 

Step 4: Create User-to-Certificate Mapping

Create the certificate mapping in ServiceNow:

  • Navigate to All → User to Certificate Mapping → New

  • Complete the required fields

  • Upload QC Cert Bundle 2026

  • Ensure the installed Quality Clouds certificate is mapped to a user with the required permissions to run Quality Clouds scans. Admin (admin role + snc_readonly) or Non-Admin

 

Step 5: Enable Certificate Authentication in Quality Clouds

Enable certificate-based authentication in the Quality Clouds Admin portal:

  • Go to Admin Portal → Account → Instance

  • Locate you Instance → Edit

  • Switch the toggle from Basic to Certificate

 

Step 6: Test Connectivity

  • Click the Test Connection icon

  • Confirm successful connectivity

 

Basic Authentication #

To connect your ServiceNow instance using Basic Authentication, follow the instance configuration steps described above

Authentication Method #

  • Set the authentication method to BASIC.

  • Enter the Username and Password of a ServiceNow user.

User Requirements #

The ServiceNow user must:

  • Have local authentication enabled (not dependent on SSO or external identity providers)

  • Have access to the REST API

  • Choose between Admin or Non-Admin user: If you decided for an Admin user, the following roles need to be provided

    • admin

    • snc_read_only

 

OAUTH Protocol #

Quality Clouds also supports the OAuth protocol to authenticate the connection between the Quality Clouds back end and your ServiceNow instances

To configure OAuth connectivity, the following steps need to be performed:

⚠️ Important –> Please ensure the following system property is set to TRUE

glide.oauth.inbound.client.credential.grant_type.enabled

This allows the use of the Client Credentials grant type, enabling external applications to obtain an access token using a client_id and client_secret, without requiring user interaction. This is required for automated integrations

 

1. Define the OAuth-authenticated Inbound Connection in ServiceNow

 #
  • From the Filter Navigator, access System OAuth → Inbound Integrations. Then click on “New Integration”
  • Select OAuth – Client credentials grant (This is the only OAuth integration type currently supported by Quality Clouds)

Enter the following values in the form:

  • Name: Any descriptive name for the Inbound Integration

  • Provider Name: Any descriptive name for the integration provider, suggestion is “Quality Clouds”

  • OAuth application user: → ⚠️ Important:  This must be the same user you are currently using to perform full scans. If this is a new setup, it must be a user with the access levels described in this page Connect Your ServiceNow Instance to Quality Clouds

  • Client Id: Will be auto-generated

  • Client Secret: A random string, between 32 and 64 characters in length. Use Base64URL encoding preferably.

  • Auth Scope: → ⚠️ Important: create a new auth scope, with any name (for instance, qc_scope). It MUST include the following APIs:

    • Table API

    • Aggregate API

    • Quality Clouds Seed Token (Quality Clouds Scripted REST API – will be available to select only after the Quality Clouds application is installed in the instance)

    • Quality Clouds Retrieve Scan Issues (Quality Clouds Scripted REST API – will be available to select only after the Quality Clouds application is installed in the instance)

  • Allow access only to APIs in selected scope: Leave Checked

⚠️ Important to consider the impact of Auth Scopes on existing integrations:

If other OAuth integrations in the instance are configured without scopes, introducing a scoped configuration may cause those integrations to stop working as expected. 

Ideally, all integrations should follow a consistent approach:

    • Either all use scopes, or
    • None use scopes

ServiceNow recommends using scopes to clearly define API access boundaries and improve security.

Note: The screenshots shown correspond to the Zurich version of ServiceNow. If you are using a different version (e.g., Yokohama), the interface and forms may vary slightly.

2. Configure the instance with OAuth authentication in the Quality Clouds portal #

When you define your instance in the Quality Clouds portal, select “OAuth” as the Authentication mechanism.

Make sure that the values are filled in as follows

  • In the Client Id and Client Secret fields, enter the same values you entered in the OAuth connection in ServiceNow

  • In token URL, the default is “https://your-instance-name.service-now.com/oauth_token.do”. This should work unless there is anything specific customization in your instance which requires another Token URL

  • In Refresh token URL, enter any value (Note: This field is irrelevant for the client credentials grant type and it will be removed from the form in the next release)

  • In Scope, enter the value for the auth scope you defined in the OAuth connection in ServiceNow

With these settings the authentication check in the admin portal should complete sucessfully, and all application features (especially Update Set LiveChecks) should work correctly.

Was it helpful ?
Table of contents

THE AI CODE GOVERNANCE BRIEF

Sign up for new updates!
ServiceNow
Salesforce