---
title: Configure API key - Token-based authentication
description: Configure an API key to support authentication for REST API endpoints.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/configure-api-key.html
release: australia
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [API Key and HMAC Authentication for inbound REST APIs, Token-based authentication, API Authentication, Authentication, Access Management]
---

# Configure API key - Token-based authentication

Configure an API key to support authentication for REST API endpoints.

## Before you begin

Role required: api\_service\_admin, adaptive\_auth\_policy\_admin

Plugin required: API Key and HMAC Authentication \(`com.glide.tokenbased_auth`\)

## Procedure

1.  Create an inbound authentication profile.

    1.  Navigate to **All** > **System Web Services** > **API Access Policies** > **Inbound Authentication Profiles**.

    2.  Select **New**.

        The system displays the message `What kind of authentication profile?`

    3.  Select **Create API Key authentication profiles**.

        \[Omitted image "api-profile.png"\] Alt text: API Key authentication profile

    4.  On the form, fill in the fields.

<table id="table_pdg_vvm_nzb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name to identify the authentication policy.

</td></tr><tr><td>

Application

</td><td>

Scope of the authentication policy.

</td></tr><tr><td>

Auth Parameter

</td><td>

Select the auth parameter for the authentication request. You can select the default options or create a new auth parameter:-   x-sn-apikey: Auth Header
-   x-sn-apikey: Query Parameter header


</td></tr></tbody>
</table>        **Note:** The selected option has to be defined in the REST call in the Auth Header or Query Parameter.

        \[Omitted image "api-parameter.png"\] Alt text: API Parameter

        **Note:** If you wish to add a prefix for the API-Key, Open the Auth Parameter file that you have selected and specify the **Prefix** field.

    5.  Submit the form.

2.  Create a REST API key.

    1.  Navigate to **All** &gt; **System Web Services** &gt; **API Access Policies** &gt; **REST API Key**.

    2.  Select **New**.

    3.  On the form, fill the fields:

<table id="table_ehg_jtx_mzb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name to identify the REST API Key

</td></tr><tr><td>

Description

</td><td>

Description for the REST API Key.

</td></tr><tr><td>

Active

</td><td>

Status of the REST API Key.

</td></tr><tr><td>

User

</td><td>

User associated to the REST API Key. Use the look-up icon to select the user.

</td></tr><tr><td>

Auth Scope

</td><td>

Option to add auth scope to manage the authority of the REST API Key.

</td></tr><tr><td>

Token

</td><td>

The REST API key generated by the ServiceNow AI Platform. Copy the key to use as part of the REST API call within the Header or Query parameter.

</td></tr><tr><td>

Expiry

</td><td>

Time after which the credential is no longer valid. Empty value means no expiration.**Note:** For more information, about expiry of token, see [Cleaning up token Expiry](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/token-expiry-api-and-hmac.md) .

</td></tr></tbody>
</table>    4.  Submit the form.

    5.  Open the record that was created to view the token generated by the ServiceNow AI Platform for the user.

        \[Omitted image "api-token.png"\] Alt text: API Token

3.  Create a REST API Access policy.

    1.  Navigate to **All** &gt; **System Web Services** &gt; **REST API Access Policies**.

    2.  Select **New**.

    3.  On the form, fill in the fields.

<table id="table_d4x_w45_d4b"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Unique name of the API access policy.

</td></tr><tr><td>

Active

</td><td>

Option to make the API access policy active.

</td></tr><tr><td>

REST API

</td><td>

The REST API to which the access policy is applied. For example, **Attachment API**.

</td></tr><tr><td>

REST API PATH

</td><td>

API path of the REST API. This field is auto-populated based on the selected REST API. For example, **now/attachment**.

</td></tr><tr><td>

HTTP Method

</td><td>

Method used for interacting with the API. This field is auto-populated based on the selected REST API.

</td></tr><tr><td>

Version

</td><td>

Version of the API. For example, **v1**. This field is auto-populated based on the selected REST API.**Note:** If you want to create an authentication policy for all versions of a REST API, you must create individual policies for each version.

</td></tr><tr><td>

Resource

</td><td>

Child resource of the REST API. This field is auto-populated based on the selected REST API. For example, **/now/attachment**

</td></tr><tr><td>

Application

</td><td>

Scope of the application.

</td></tr><tr><td>

Global

</td><td>

Enable this field to apply auth policy to all methods, versions, and resources for the API.**Note:** Token Based Auth isn’t allowed in the Global REST API Policy.

</td></tr><tr><td>

Apply to all methods

</td><td>

Enable this field to apply the auth policy for the API to all the methods, versions, and resources for the API.

</td></tr><tr><td>

Apply to all resources

</td><td>

Enable this field to apply the auth policy for the API to all the versions.

</td></tr><tr><td>

Apply to all versions

</td><td>

Enable this field to apply the auth policy for the API to all the resources.

</td></tr></tbody>
</table>        \[Omitted image "add-api-key-policy.png"\] Alt text: Add profile to Access Policy

    4.  Add the API Authentication profile that was created.

    5.  Submit the form.

    You can send the REST API call with the x-sn-apikey \(token\) that was generated by the ServiceNow AI Platform during the API Key creation within the Header or Query parameter based on the configuration for authentication.

    **Warning:** Use **POST** request when submitting any sensitive information to the server.