API Credential Self-Service

x_devlnt_apicred

Service-account owners rotate and revoke their OAuth client-credentials keys, with zero-downtime rotation.

About

Owners of a service account rotate and revoke its client-credentials OAuth keys themselves, from the portal page /sp?id=api_credentials. Rotation keeps two keys live, so integrations switch to the new key without downtime.

What it does

Create new key: adds a second OAuth client for the same service account, copies the token settings, auth scopes and Allow access only to APIs in selected scope setting of the newest key, and clones its inbound authentication profiles and API access policy mappings, so the new key never has broader access than the old one. The secret is generated by the platform and shown once.
View secret: an administrator still creates an account's first key natively; a member of an owning group then views that key's secret once in the portal, so the administrator never has to pass it on.
Revoke: deactivates a key at once and expires its tokens.
Purge (admins): deletes a revoked key with its tokens, profiles and mappings, and refuses when that would leave an API access policy without an authentication profile.
Rotation reminders: keys older than x_devlnt_apicred.rotate_after_days (90 by default) are flagged, and the owning group is notified daily.
Email notifications to the owning group when a key is created or revoked. Secrets are never logged, stored by the app or mailed.
A Prerequisites page that checks the instance setup.

Only service accounts are covered: users with Identity type set to Machine (Web service access only). The app ignores every other user's OAuth clients, and it never creates an account's first client.

Installing

Every release includes a Global update set with the bridge the app needs to write OAuth records, which a scoped app cannot do. Install it first, then the app. After installing:

Check that global.ApiCredBridge is active and accessible from all application scopes, and that the Global property apicred.bridge.allowed_scopes is x_devlnt_apicred.
Make sure glide.oauth.inbound.client.credential.grant_type.enabled is true.
Confirm the four ACLs on the Owner table imported with the app.
Add the api_credentials page to your portal (it is created on sp).
Grant x_devlnt_apicred.admin with care: the role, like membership of an owning group, is the power to mint working credentials for the covered service accounts.
Add Owner rows (owning group + service account), then open API Credential Self-Service > Prerequisites. Nothing may be marked BLOCKING.

Version history

1.2.0 latest

Sep 30, 2026 · 170 KB · zip · app + Global update set

Supports Zurich, Australia

View an admin-created key's secret once. An administrator still creates a service account's first key natively, but no longer has to copy its secret and pass it on: a member of an owning group clicks View secret on that key in the portal and sees the secret once. After that nobody can view it in the portal again. The x_devlnt_apicred.admin role alone is not enough, so an administrator browsing the page cannot use up the view.
New keys copy the auth scopes of the existing key. Create new key now also copies the key's auth scopes and its Allow access only to APIs in selected scope setting, so a rotated key never has broader access than the key it replaces. Before, the new key was always unrestricted.
The Global bridge is now version 1.2.0 and the app requires it. Install the Global update set from this release; it replaces the older bridge.

Global update set

Global utilities the app needs outside its own scope: the Script Include global.ApiCredBridge (version 1.2.0) and the Global property apicred.bridge.allowed_scopes, preset to x_devlnt_apicred. It is the complete bridge, so it installs on its own, whether or not an older bridge was installed before.

A scoped app cannot write OAuth clients, their auth scopes, inbound authentication profiles or their policy mappings, and cannot read a client secret, so the app does all of this through the bridge. The bridge accepts calls only from the scopes listed in apicred.bridge.allowed_scopes, re-checks ownership itself, and touches only client-credentials clients of service accounts (Identity type Machine with Web service access only). Anyone who can edit Global properties can add a scope, so treat that property like the app's admin role.

sha256 6a911e2f…c8aed912

1.1.0

Sep 29, 2026 · 142 KB · zip · app + Global update set

Supports Zurich, Australia

Service accounts are now users with Identity type set to Machine and Web service access only set. Internal Integration User is no longer checked: an account that only had that flag is no longer covered, and its keys disappear from the page.
The Global bridge is now version 1.1.0 and applies the same rule. Install the Global update set from this release; it replaces the 1.0.0 bridge.

Global update set

Global utilities the app needs outside its own scope: the Script Include global.ApiCredBridge (version 1.1.0) and the Global property apicred.bridge.allowed_scopes, preset to x_devlnt_apicred. It is the complete bridge, so it installs on its own, whether or not 1.0.0 was installed before.

A scoped app cannot write OAuth clients, inbound authentication profiles or their policy mappings, so the app does every such write through the bridge. The bridge accepts calls only from the scopes listed in apicred.bridge.allowed_scopes, re-checks ownership itself, and touches only client-credentials clients of service accounts (Identity type Machine with Web service access only). Anyone who can edit Global properties can add a scope, so treat that property like the app's admin role.

sha256 df0a8879…d47d4ad2

1.0.0

Sep 28, 2026 · 138 KB · zip · app + Global update set

Supports Zurich, Australia

First release: self-service creation, revocation and purging of client-credentials OAuth keys for service accounts, with zero-downtime rotation.
Rotation reminders, email notifications to owning groups, and a Prerequisites page.
ATF suite API Credential Self-Service (11 tests); it needs the Global update set installed.

Global update set

Global utilities the app needs outside its own scope: the Script Include global.ApiCredBridge and the Global property apicred.bridge.allowed_scopes, preset to x_devlnt_apicred.

A scoped app cannot write OAuth clients, inbound authentication profiles or their policy mappings, so the app does every such write through the bridge. The bridge accepts calls only from the scopes listed in apicred.bridge.allowed_scopes, re-checks ownership itself, and touches only client-credentials clients of service accounts. Anyone who can edit Global properties can add a scope, so treat that property like the app's admin role.

sha256 4a202fae…b478a31e

Installing and upgrading

Install on every instance. Import the same update set XML into each instance that should run the app — dev, test and prod — or retrieve it from dev through an update source. Every release contains the complete app, so you can upgrade from any earlier version straight to the latest.

Check your release first. Each version lists the ServiceNow releases it supports. Your instance's release is the Build name on stats.do, or the glide.buildname property. If it isn't listed for the version you want, contact Devolent before you import.

Global update set. Some releases include a Global update set with utilities the app needs outside its own scope. Install it first, on every instance, and import it again whenever a release includes it. It lives in Global, so Application Manager does not list it under the app. Don't edit it: like the app, it is overwritten on upgrade.

"External application" is expected. The app lives in Devolent's scope, x_devlnt_apicred, so Application Manager labels it an external application and won't let you publish it to your company's application repository. Move it between instances with update sets as described above.

Upgrading. Import the newer file the same way on each instance, starting with dev. Preview flags any records you have changed locally, so review those before you commit.

Extend it, don't edit it. Devolent owns the app and ships every fix and new version. Changes made inside the app's scope are overwritten or flagged on the next upgrade, and a modified app is outside Devolent's support. Where the app allows it, put your own logic in your own scope, where it survives upgrades. Need something the app doesn't offer? Contact Devolent.

Latest release

v1.2.0 Sep 30, 2026

File: zip · 2 update sets
Size: 170 KB
Checksum: 6a911e2f…c8aed912
Supports: Zurich · Australia

Contains

1 Global update set Global utilities the app needs outside its own scope: the Script Include `global.ApiCredBridge` (version 1.2.0) and the Global property `apicred.bridge.allowed_scopes`, preset to `x_devlnt_apicred`. It is the complete bridge, so it installs on its own, whether or not an older bridge was installed before.
2 App update set x_devlnt_apicred

Install on your instance

1Download the zip and unzip it.
2Import 1_api-credential-self-service_v1.2.0_global.xml under Retrieved Update Sets. Preview, then Commit.
3Import 2_api-credential-self-service_v1.2.0.xml the same way.
4Repeat on each instance — dev, test, prod. Upgrades are the same steps with a newer zip.