Support OAuth 2.0 authentication for SDK CLI (build/install/download)

[IhorKochetkov]

Currently, now-sdk install and now-sdk download require Basic Auth credentials (SN_USERNAME / SN_PASSWORD environment variables in CI mode). This forces teams running the SDK in automated pipelines (e.g., MCP servers, CI/CD) to store a service account's username and password as secrets.

Would the team consider adding OAuth 2.0 (Authorization Code or Client Credentials grant) as an authentication option for SDK CLI operations?

Use case: We run an MCP server that uses the SDK to build and deploy scoped apps to ServiceNow. The server already authenticates to the instance via OAuth 2.0 for all Table API operations. But for SDK operations (install, download), we have to fall back to storing a service account's username/password on the server because the SDK CLI doesn't accept OAuth tokens.

What this would enable:

• Pass an existing OAuth bearer token to SDK CLI commands (e.g., --token flag or SN_OAUTH_TOKEN env var)
• Eliminate the need to store long-lived credentials for SDK-only operations
• Align with ServiceNow's own push toward OAuth for API access

Happy to provide more details on the integration pattern if helpful.

[sonisoft-cnanda]

Not sure what you mean, SDK cli when adding auth aliases now inherently supports OAuth2. Thats exactly why I used the now-sdk as the base for my cli and mcp, because it inherently already used that. Its been available for a year and a half or so?

You do need the IDE installed or install the update set with the application registry for it to work, but its there when you add a new alias.

[IhorKochetkov]

Thanks for the pointer! I use now-sdk install in CI mode (headless, no browser — running on a Railway server). In that context I've only found SN_USERNAME/SN_PASSWORD env vars working.

Could you point me to how you pass OAuth credentials in a headless/CI environment? Specifically: can an auth alias with OAuth tokens be used non-interactively for install/download? Any docs or examples would be really helpful.

[IhorKochetkov]

To give more context on the architecture:

User (Claude/Cowork) → Remote MCP Server (Railway)
  ↓ OAuth 2.0 (Authorization Code)
  ServiceNow Inbound Integration (Application Registry)
  ↓ Bearer token
  Table API / REST API calls ✅ (works great)
  ↓
  now-sdk install / download ❌ (no way to pass the Bearer token)
  → falls back to SN_USERNAME/SN_PASSWORD (service account)

The MCP server authenticates users via ServiceNow's OAuth 2.0 provider (Inbound Integration entry in the Application Registry). All Table API operations use the resulting Bearer token per-user — this works perfectly.

But when I need to run now-sdk build → now-sdk install on the same server, the SDK CLI doesn't accept the Bearer token I already have. I have to store a separate service account's username/password in env vars. That's the gap — I already have a valid OAuth token but can't pass it to the SDK.