Every request to our API still carries an integration account's username and password. In this video we switch to OAuth 2.0, so clients identify themselves once and then authenticate with a short-lived access token instead. We build this on a new v3 of the Vehicles API. *You'll learn:* - How the OAuth 2.0 client credentials grant works, and why it's the right flow for machine-to-machine integrations - The difference between client credentials (client ID and secret) and account credentials (username and password) - How to enable the grant type, register an external application, request an access token, and call the API with a bearer token *Chapters:* - 0:00 Introduction - 0:19 Concept - 2:54 Versioning - 3:20 Demo - 4:43 Testing - 7:53 Outro *GitHub:* https://github.com/jnichols-servicenow/SN2026-Vehicles-API *Links:* - ServiceNow docs – OAuth 2.0applications (inbound) – https://www.servicenow.com/docs/r/platform-security/authentication/c\_OAuthApplications.html - ServiceNow docs – Inbound integrations – https://www.servicenow.com/docs/r/platform-security/authentication/new-inbound-integrations.html - OAuth 2.0 (RFC 6749) – https://www.rfc-editor.org/rfc/rfc6749 - Postman – https://www.postman.com/ *Series navigation:* - Previous: 15 – GlideRecordSecure() - Next: 17 – Authentication scopes - Full playlist: https://www.youtube.com/playlist?list=PLrhqGp3sUzhvp1sfgP8OZjXRxKOP\_cyBU