--- title: Configure the OAuth authentication method production instance description: Export OAuth records from the development instance, import them into the production instance, and correct Key Management Framework \(KMF\) credential encryption. Configure development-to-production authentication so that both instances can validate their connections to each other. locale: en-US canonical_url: https://www.servicenow.com/docs/r/impact/configure-oauth-auth-method-prod.html release: brazil topic_type: task last_updated: "2026-10-27" reading_time_minutes: 8 breadcrumb: [Configure the OAuth authentication method development instance, Register your instance, Scan Engine integrations, Activate Scan Engine and review settings, Configuring Impact, Impact] --- # Configure the OAuth authentication method production instance Export OAuth records from the development instance, import them into the production instance, and correct Key Management Framework \(KMF\) credential encryption. Configure development-to-production authentication so that both instances can validate their connections to each other. ## About this task After the development instance is validated, see [Configure the OAuth authentication method development instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/configure-oauth-auth-method.md), the production instance must be able to communicate with development, and development must be able to communicate with production. This requires two rounds of record export and import; one in each direction with KMF credential correction performed after each import. **Important:** When OAuth records are imported into a new instance, KMF re-encrypts password fields using the receiving instance's cryptographic key. The stored values appear jumbled and must be manually overwritten with the correct password before the connection can be validated. ## Before you begin - Complete [Configure the OAuth authentication method development instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/configure-oauth-auth-method.md) on the development instance and confirm that the development connection validates successfully. - The integration user account must already exist on the production instance with the `sn_se.scan_engine_admin` and `sn_se.internal_rest_integration` roles assigned. See [Create an integration user account](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/task-create-integration-user.md). - Have the integration account password available in a text editor. You will paste it multiple times during this procedure. - Role required: Scan Engine Admin \(`sn_se.scan_engine_admin`\). ## Procedure 1. Stage 1: Export OAuth records from the development instance 2. On the development instance, navigate to **All** > **Scan Engine** > **My SN Instances** and open the development instance record. 3. Select and hold \(or right-click\) the form header of the My SN Instances record and select **Export** > **XML**. 4. Save the file to a local folder \(for example, `SE_Data`\). 5. From the My SN Instances record, drill into the **OAuth User Profile** field, open the linked record, and export it as XML. 6. Navigate to **All** > **System OAuth** > **Application Registry** and filter the list to show only records scoped to **Scan Engine**. \[Omitted image "scan-engine-app-registry-filterout.png"\] Alt text: Application registry filtering Scan Engine scope. Two records should be present: `OAuth Client Dev` and `OAuth Provider Dev`. 7. Select both records and export them together as XML. 8. Open the **OAuth Provider Dev** record and locate the auto-generated OAuth entity profile record linked at the bottom of the form. \[Omitted image "scan-engine-oauthprovider-dev-profile.png"\] Alt text: OAuth entity profile for OAuth Provider Dev. 9. Open the OAuth entity profile record and export it as XML. You should now have four XML files in your export folder: - MySN instance record - OAuth user profile - Two application registry records \(OAuth Client Dev and OAuth Provider Dev\) - OAuth entity profile record 10. Stage 2: Prepare Key Management Framework access on the production instance 11. Grant KMF access to your setup user on the production instance, using [Grant Key Management Framework access on an instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/complete-kmf-access.md). Complete the steps in that task before you continue. 12. Stage 3: Import development records into the production instance 13. On the production instance, navigate to **All** > **Scan Engine** > **My SN Instances**. 14. Import the four XML files in the following order, using **Import XML** for each file: 1. OAuth entity profile record 2. Second OAuth entity profile record \(if present\) 3. MySN instance record 4. OAuth user profile \(OAuth2 configuration\) record 15. Stage 4: Correct KMF-encrypted credentials on the production instance 16. Navigate to `sys_auth_profile_oauth2.list` and open the **Integration Account** OAuth user profile record. 17. Switch the application scope to **Scan Engine**. 18. If the **Username** and **Password** fields are not visible, configure the form to display them, or open the record using the list layout. When prompted whether to edit in Scan Engine or Global scope, select **Global** for the form configuration only. 19. Overwrite the **Password** field with the integration account password from your text editor and select **Save**. Importing the record causes KMF to re-encrypt the password field with the production instance key. Overwriting it restores the correct value. 20. Navigate to **All** > **System OAuth** > **Application Registry** and open **OAuth Client Dev**. 21. Unlock the **Client Secret** field, overwrite it with the integration account password, and select **Save**. 22. Return to the Application Registry list and open **OAuth Provider Dev**. 23. Unlock the **Client Secret** field, overwrite it with the integration account password, and select **Save**. 24. Stage 5: Grant KMF module access and validate the development connection 25. Complete the KMF module access policy steps in [Grant Key Management Framework access on an instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/complete-kmf-access.md), including the step that sets the Scan Engine script include to Track. 26. Navigate to **All** > **Scan Engine** > **My SN Instances**, remove any active filters, and open the development instance record. 27. Select **Validate Connection**. Connection Status updates to `Connection Valid`. The production instance can now communicate with the development instance. See [Validate your instance connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/validate-instance-connection.md) for additional information. 28. Stage 6: Create the OAuth client and provider for the production instance 29. Confirm the application scope is set to **Scan Engine**. 30. Navigate to **All** > **Scan Engine** > **My SN Instances** and confirm that a My SN Instances record exists for the production instance. If the production instance record has not been created yet, complete [Register your instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/register-your-instance.md) before continuing as follows. The record must exist before OAuth fields can be configured. |Field|Value| |-----|-----| |Instance Name|The instance name as it appears in `stats.do` for the production instance.| |Instance URL|The full URL of the production instance. Select the lock icon next to the field to enter the URL.| |Environment|**Production**| 31. Navigate to **All** > **System OAuth** > **Inbound Integrations** and select **New Integration**. 32. Select **Resource Owner Password Credential Grant** and complete the fields in the following table. |Field|Value| |-----|-----| |Name|OAuth Client Prod| |Provider Name|Leave empty.| |Client ID|Copy the auto-generated value to your text editor for use in the next step.| |Client Secret|Enter the integration account password.| |Auth Scope|**useraccount**| |Advanced options: Token Format|**Opaque**| 33. Select **Save**. 34. Navigate to **All** > **System OAuth** > **Application Registry** and select **New**. 35. Select **Connect to an OAuth Provider \(simplified\) — Outbound** and complete the fields in the following table. |Field|Value| |-----|-----| |Name|OAuth Provider Prod| |Client ID|Paste the client ID copied from OAuth Client Prod.| |Client Secret|Enter the integration account password.| |Default Grant Type|Resource Owner Password Credentials| |Redirect URL|Select the redirect URL for the production instance. Example: https://instancename.service-now.com/oauth\_redirect.do| |Token URL|Use the redirect URL with the path changed to `oauth_token.do`. Example: https://instancename.service-now.com/oauth\_token.do| 36. Select **Save**. An OAuth entity profile record is automatically generated and appears at the bottom of the form. Leave this record as-is. 37. Stage 7: Link OAuth records to the production MySN instance and validate 38. Navigate to **All** > **Scan Engine** > **My SN Instances** and open the production instance record created in [Register your instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/register-your-instance.md). 39. Complete the fields in the following table. |Field|Value| |-----|-----| |Authentication Type|OAuth| |OAuth Application Registry|OAuth Provider Prod| |OAuth User Profile|Select the existing Integration Account profile \(the same profile used for the development connection\).| 40. Select **Save**, then select **Validate Connection**. **Note:** Because the KMF module access policy for the `ScanEngineApiUtil` script include was already set to **Track** in Stage 5, the connection should validate immediately without additional KMF steps. See [Validate your instance connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/validate-instance-connection.md) for additional information. Connection Status updates to `Connection Valid`. 41. Stage 8: Export production records and import into the development instance 42. From the production instance, navigate to **All** > **System OAuth** > **Application Registry** and export the following records as XML: - **OAuth Client Prod** - **OAuth Provider Prod** - The **OAuth entity profile** auto-generated by OAuth Provider Prod 43. Export the production My SN Instances record as XML. 44. Log in to the development instance and navigate to **All** > **Scan Engine** > **My SN Instances**. 45. Import the four XML files using **Import XML**. 46. Navigate to **All** > **System OAuth** > **Application Registry** and correct the KMF-encrypted client secret on both **OAuth Client Prod** and **OAuth Provider Prod** by overwriting each with the integration account password. See Stage 4 for the correction procedure. 47. Navigate to **All** > **Scan Engine** > **My SN Instances**, remove any active filters, and open the production instance record. 48. Select **Validate Connection**. Connection Status updates to `Connection Valid`. Both instances now have valid My SN Instances records for development and production. ## Result Both the development and production instances have validated My SN Instances records in each direction. Definition synchronization, update set summary synchronization, and exception reason synchronization are now available. ## What to do next - [Definitions integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/definitions-integrations.md) - [Exception reason integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/exception-reason-integration.md) - [User story integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/user-story-integration-properties.md) - [Deployment and synchronization integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/deployment-sync-integrations.md) **Parent Topic:**[Configure the OAuth authentication method development instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/impact/configure-oauth-auth-method.md)