--- title: Set up the SuccessFactors spoke v4.x.x description: Integrate the ServiceNow instance with your SuccessFactors instance using OAuth client application and API key.Enable client certificate authentication for the outbound communication by generating the keystore.jks and keystore.cer files.Enable client certificate authentication for the outbound communication by uploading the JKS certificate in your ServiceNow instance.Use the API key generated during the client application configuration to register the application as an OAuth provider.Create a SAML2 assertion record to generate the SAML2 assertion and exchange the assertion for the access tokens with the provider.Create Credential record for the OData APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the OData API.Create Credential record for the SOAP APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the SOAP APIs.Create a Connection record for the OData API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors.Create a Connection record for the SOAP API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors.Customise the sample flows as per your requirement to synchronize data between your SuccessFactors and ServiceNow instances. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/integrate-applications/integration-hub/setup-successfactors.html release: australia product: Integration Hub classification: integration-hub topic_type: task last_updated: "2026-03-12" reading_time_minutes: 10 breadcrumb: [SuccessFactors Spoke, Integration Hub spokes, Build integrations, Integration Hub, Workflow Data Fabric] --- # Set up the SuccessFactors spoke v4.x.x Integrate the ServiceNow instance with your SuccessFactors instance using OAuth client application and API key. ## Before you begin - Request an Integration Hub subscription. - Activate the SuccessFactors spoke. - Enable these system properties: - **glide.pf.rest.response\_payload\_max\_size**: The maximum value is, `10240`. - **com.snc.process\_flow.reporting.serialized.val\_size\_limit**: The maximum value is, `16384`. - **com.glide.transform.json.max-partial-length**: The maximum value is, `65536`. - Role required: admin. **Note:** This procedure is applicable if you are setting up the SuccessFactors spoke v4.12.0 for the first time. If you are using an earlier version of the SuccessFactors spoke, see [Migrate to SuccessFactors spoke v4.12.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/migrate-successfactors.md) for the migration procedure. For more information about setting up the spoke, see [SAP SuccessFactors Spoke - OAuth Setup & Migration - Pre-Tokyo, Tokyo and beyond](https://www.servicenow.com/community/knowledge-managers/sap-successfactors-spoke-oauth-setup-amp-migration-pre-tokyo/ta-p/2468046) in [ServiceNow Community](https://www.servicenow.com/community/). ## Register OAuth client application in SuccessFactors Enable client certificate authentication for the outbound communication by generating the keystore.jks and keystore.cer files. ### Before you begin - Generate a valid JKS certificate. For information about creating a JKS certificate, see [Creating Java Keystore\(JKS\) with Private Key and Certificate Chain](https://help.sap.com/docs/SAP_Cloud_Platform_Master_Data_for_Business_Partners/246fb358c1c7413289c03b8c72734209/18f5bae37a664396b2ebbc1b3c384c53.html) in [SAP Help Portal](https://help.sap.com/docs/), or, do the steps. 1. Use the command `openssl genrsa -out private.key 2048` to generate the private.key file. 2. Use the private.key to create x.509 certificate \(.cer file\) that contains your public key. Use the command `openssl req -new -x509 -key private.key -out publickey.cer -days 365` - Convert the public and private key to a .p12 file. Use the command to do the above step `openssl pkcs12 -export -in publickey.cer -inkey private.key -out successfactors.p12 -name "".` - Convert the .p12 file to .jks Use the command to do the above step `keytool -importkeystore -srckeystore successfactors.p12 -srcstoretype pkcs12 -destkeystore successfactors.jks`. - Role required: admin. ### Procedure 1. Log in to the SuccessFactors account as an admin. 2. Navigate to **Admin Centre** and click **Company Settings**. 3. Click **Manage OAuth2 Client Applications**. 4. Click **Register Client Application**. \[Omitted image "sapsf-oauth-app.png"\] Alt text: Register a client application. 5. Provide the required details on the form. In the **X.509 Certificate** field, provide contents of the cert.pem file \(public key\) without the headers. 6. Click **Submit**. **API Key** is generated and displayed. Copy and record the value for later use. ## Upload the JKS certificate in your ServiceNow instance Enable client certificate authentication for the outbound communication by uploading the JKS certificate in your ServiceNow instance. ### Before you begin Role required: admin ### Procedure 1. Log in to your ServiceNow instance as an admin. 2. Upload the JKS certificate to your ServiceNow instance. For instructions to upload the JKS certificate, see [Upload a certificate to an instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_UploadACertificateToAnInstance.md) . \[Omitted image "sapsf-cert.png"\] Alt text: Upload JKS certificate. ## Register SuccessFactors as an OAuth provider Use the API key generated during the client application configuration to register the application as an OAuth provider. ### Before you begin Role required: admin ### Procedure 1. In your ServiceNow instance, navigate to **System OAuth** > **Application Registry**. 2. Click **New**. 3. In the form, fill in these fields.
Field Description
Name Unique name to identify the certificate. For example, `SuccessFactors SAML`.
Client ID Value of the API key you had copied after registering the OAuth client application in SuccessFactors.
Client Secret **Note:** Client secret is not needed to register the application as an OAuth provider. You can provide any value for this field.
OAuth API Script Name of the OAuth API script. Search for `OAuthUtilSuccessFactors` and select it from the list.
Default Grant Type Default grant type used to establish the token. Select **SAML2 Bearer**.
Token URL SuccessFactors OAuth server endpoint URL that includes the Company ID in this format: `https:///oauth/token?company_id=`. For example, `https://example.successfactors.eu/oauth/token?company_id=SFCPART123456`.
\[Omitted image "sapsf-app-reg.png"\] Alt text: Application registry record. 4. Click **Submit**. ## Create the SAML2 assertion producer record Create a SAML2 assertion record to generate the SAML2 assertion and exchange the assertion for the access tokens with the provider. ### Before you begin Role required: admin ### Procedure 1. Create a SAML2 assertion producer record in your ServiceNow instance. 1. Navigate to **All** > **System OAuth** > **SAML2 Assertion Producers**. 2. Click **New**. 3. On the form, fill these values. |Field|Description| |-----|-----------| |Name|Unique name to identify the SAML2 assertion producer record. For example, `Successfactor SAML OAuth`.| |Issuer|Unique identifier for the assertion issuing entity. Provide the ServiceNow instance URL.| |Subject NameID|User name to log in to the SuccessFactors instance. For example, `sfadmin`.| |Audience|Intended audience for the assertion. Enter the value, `www.successfactors.com`.| |Recipient|Intended recipient for the assertion. Enter URL in this format, `https:///oauth/token`.| \[Omitted image "successfactors-saml2-assertion-prod.png"\] Alt text: SAML2 assertion producer record. 4. Right-click the form header and click **Save**. 5. Under the **SAML2 Assertion Keystores** tab, click **New**. 6. On the form, fill these values. |Field|Description| |-----|-----------| |Name|Unique name to identify the SAML2 assertion keystore record. For example, `sap_successfactor`.| |Signing Key Alias|Alias of key entry stored in the Keystore used to sign the assertion. For example, `1`.| |Signing Key Password|Password of the key entry stored in the keystore used to sign the assertion.| |Signing Keystore|Required X.509 certificate record. Select the X.509 certificate record that you had earlier created. For more information, see [Upload the JKS certificate in your ServiceNow instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md).| \[Omitted image "sapsf-assertion-ks.png"\] Alt text: SAML2 assertion keystore record. 7. Click **Submit**. 8. Navigate to **All** > **System OAuth** > **SAML2 Assertion Producers**. 9. Open the SAML2 assertion producer record that you had created. For example, **Successfactor SAML OAuth**. 10. Under the **SAML2 Assertion Attributes** tab, click **New**. 11. On the form, fill these values. |Field|Description| |-----|-----------| |Name|Name to identify the SAML2 assertion attribute record. Enter `api_key`.| |Type|Type of the **Value** field. Select **String**.| |Value|API key generated after the OAuth client application is created in SuccessFactors.| \[Omitted image "sapsf-assertion-attribute.png"\] Alt text: SAML2 assertion attribute record. 12. Click **Submit**. 2. Associate the SAML2 assertion producer with the application registry record. 1. Navigate to **System OAuth** > **Application Registry**. 2. Open the application registry record that you had created. For example, **SuccessFactors OAuth Reg**. For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md). 3. Under the **OAuth Entity Profiles** tab, open the default OAuth entity profile record. For example, **Successfactor SAML default\_profile**. 4. For the **Assertion Producer** field, select the SAML2 assertion producer record you had created. For example, **Successfactor SAML OAuth**. \[Omitted image "sapsf-assertion-oauth.png"\] Alt text: OAuth entiy profile record. 5. Click **Update**. ## Create Credential record for the OData API Create Credential record for the OData APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the OData API. ### Before you begin Role required: admin. ### Procedure 1. Navigate to **All** > **Connections & Credentials** > **Credentials**. 2. Click **New**. The system displays the message **What type of Credentials would you like to create?**. 3. Select **OAuth 2.0 Credentials**. An empty OAuth 2.0 Credentials form is displayed. 4. On the form, fill these values.
Field Value required
Name Name to uniquely identify the record. For example, enter `SAML_SuccessFactors_OData_Cred`.
OAuth Entity Profile OAuth entity profile record that is associated with the OAuth application registry you had created. For example, `Successfactor SAML default_profile`.For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md).
Active Option to actively use the credential record.
Order Order to apply this credential. For example, enter `100`.
\[Omitted image "sapsf-odata-cred.png"\] Alt text: OData credential record. 5. Click **Submit**. ### Result The credential record to authorize actions using the OData API is created. ## Create Credential record for the SOAP API Create Credential record for the SOAP APIs in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these credentials to authorize actions using the SOAP APIs. ### Before you begin Role required: admin. ### Procedure 1. Navigate to **All** > **Connections & Credentials** > **Credentials**. 2. Click **New**. The system displays the message **What type of Credentials would you like to create?**. 3. Select **OAuth 2.0 Credentials**. An empty OAuth 2.0 Credentials form is displayed. 4. On the form, fill these values.
Field Value required
Name Name to uniquely identify the record. For example, enter `SAML_SuccessFactors_SOAP_Cred`.
OAuth Entity Profile OAuth entity profile record associated with the OAuth application registry you had created. For example, `Successfactor SAML default_profile`.For more information about creating the application registry, see [Register SuccessFactors as an OAuth provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/setup-successfactors.md).
Active Option to actively use the credential record.
Order Order to apply this credential. For example, enter `100`.
\[Omitted image "sapsf-soap-cred.png"\] Alt text: SOAP credential record. 5. Click **Submit**. ### Result The credential record to authorize actions using the SOAP API is created. ## Create Connection record for the OData API Create a Connection record for the OData API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors. ### Before you begin Role required: admin. ### Procedure 1. Navigate to **All** > **Connections & Credentials** > **Connection & Credential Aliases**. 2. Open for the record for **SuccessFactors OData**. For example, **SuccessFactors\_OData**. 3. From the **Connections** tab, click **New**. The system displays an empty HTTP\(s\) Connection form. 4. On the form, fill these values.
Field Description
Name Name to uniquely identify the record. For example, `SAML_SuccessFactors_OData_Conn`.
Credential Credential record you created for the REST API. For example, `SAML_SuccessFactors_OData_Cred`.
Connection URL SuccessFactors service root URL in this format: `https:///odata/v2`. For example, `https://example.successfactors.eu/odata/v2`.**Note:** If you are using an SAP Cloud account, see [List of SAP SuccessFactors API Servers](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/93f95815070049ebaaff042d8322d518/af2b8d5437494b12be88fe374eba75b6.html) in [SAP Help Portal](https://help.sap.com/docs/) to select the correct endpoint that is needed to target the API server.
Active Option to actively use the connection record.
\[Omitted image "sapsf-odata-conn.png"\] Alt text: OData connection record. 5. Click **Submit**. ### Result The connection record for the REST API in SuccessFactors is created. ## Create Connection record for the SOAP API Create a Connection record for the SOAP API in SuccessFactors. The SuccessFactors spoke connection and credential alias uses these connections to perform actions in SuccessFactors. ### Before you begin Role required: admin. ### Procedure 1. Navigate to **All** > **Connections & Credentials** > **Connection & Credential Aliases**. 2. Open for the record for **SuccessFactors SOAP API**. For example, **SuccessFactors\_Comp\_Emp**. 3. From the **Connections** tab, click **New**. The system displays an empty HTTP\(s\) Connection form. 4. On the form, fill these values.
Field Description
Name Name to uniquely identify the record. For example, `SAML_SuccessFactors_SOAP_Conn`.
Credential Credential record you created for the SOAP API. For example, `SAML_SuccessFactors_SOAP_Cred`.
Connection URL SuccessFactors connection URL. For example, `https:///sfapi/v1/soap`. For example, `https://example.successfactors.eu/sfapi/v1/soap`.**Note:** If you are using an SAP Cloud account, see [List of SAP SuccessFactors API Servers](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/93f95815070049ebaaff042d8322d518/af2b8d5437494b12be88fe374eba75b6.html) in [SAP Help Portal](https://help.sap.com/docs/) to select the correct endpoint that is needed to target the API server.
Active Option to actively use the connection record.
5. In the **Attributes** tab, provide these fields. |Field|Description| |-----|-----------| |Company Id|Immutable Company ID of your SuccessFactors instance.| |Flow Timeout \(seconds\)|Maximum time in seconds up to which data can be received from SuccessFactors during the flow execution. If the time taken to retrieve data from SuccessFactors exceeds the timeout duration, the flow or subflow is cancelled. Default value is, `30`.| \[Omitted image "sapsf-soap-conn.png"\] Alt text: SOAP connection record. 6. Click **Submit**. ### Result The connection record for the SOAP API in SuccessFactors is created. ## Synchronize data between SuccessFactors and ServiceNow Customise the sample flows as per your requirement to synchronize data between your SuccessFactors and ServiceNow instances. ### Todo entity The SuccessFactors spoke provides sample flows to synchronize data bi-directionally for the todo entity. The sample flow, Run SuccessFactors Integration Flow can customised to retrieve data from SuccessFactors, while the Create Todo and Update Todo flows creates or updates the todo records in SuccessFactors when events occur in ServiceNow. While customising the sample flows, ensure that you provide appropriate triggers to retrieve and save future updates using transform maps. ### Other default entities For these entities, the sample flow, Run SuccessFactors Integration Flow, can be customised to retrieve data from SuccessFactors: - Department - Location - Job Profile - Workers Profile - Effective Workers Profile - Job History Including Secondary Assignments To create or update records in SuccessFactors for these entities when events occur in ServiceNow: - Create flows or subflows as per your choice or customise the sample flows and subflows. - Use Metadata Retrieval and Record Management actions in your flows. - Ensure that you provide appropriate triggers to retrieve and save future updates using transform maps. ### Other SuccessFactors entities Depending on the SuccessFactors permissions and configurations, you can also synchronize data of other entities as per your requirement.