docs(servicenow): add auth provider page, refresh remote MCP callout

[andrewconnor-arcade]

What

Adds a ServiceNow auth provider reference page, and fixes a now-incorrect statement on the ServiceNow remote MCP server guide.

The ServiceNow toolkit shipped (monorepo #3762, #3839) and its tool reference auto-generated, but nothing documented how to actually set up the OAuth connection. The toolkit declares OAuth2(id="servicenow") and requires_secrets=["SERVICENOW_INSTANCE_URL"], and there's no Arcade-hosted ServiceNow provider, so every customer has to register their own OAuth client and wire it up. That was undocumented until now, and it's currently blocking a customer onboarding.

New page: /en/references/auth-providers/servicenow

Follows the existing custom-provider pages (Zendesk, Salesforce, Cisco Duo): create the OAuth app, get the instance URL, set the secret, configure the provider, plus app-code and custom-tool examples.

ServiceNow-specific wrinkle: OAuth client registration moved between releases, so both paths are documented in tabs.

• Machine Identity Console (Zurich and later)
• Application Registry (pre-Zurich)

Both sets of steps come from hands-on walkthroughs on real instances, not from vendor docs alone. That mattered most for scope configuration, where each path has a trap that looks like the opposite of the other:

• On Machine Identity Console, you actively select useraccount, then have to ignore two alarming-looking signals: an API-restriction checkbox that disables itself, and a yellow "assign only non-sensitive API scopes" banner. Both are expected. Narrowing the scope to silence them breaks the toolkit.
• On Application Registry, you leave scopes alone. The default is already useraccount, and adding even one narrower scope to the Auth Scopes related list flips the record into a strict allow-list that blocks APIs the toolkit needs.

useraccount is the scope that preserves the caller's own ACLs, which the toolkit's fulfiller/requestor access model depends on.

Updated: /en/operate/governance/remote-mcp-servers/servicenow

The page carried a callout stating "Arcade doesn't ship a ServiceNow toolkit today," written before the toolkit existed. It now points at the toolkit and the new auth page, and frames MCP Server Console as the path for instance-specific tools a generic toolkit can't pre-build (Now Assist Skills, Subflows, Scripted REST APIs).

Worth fixing promptly: this page is the one we hand to customers evaluating ServiceNow, so it was actively telling them the toolkit didn't exist.

Notes for review

• The custom-tools example uses arcade_mcp_server rather than the older arcade_tdk that Zendesk's example uses, matching the canonical tool-authoring guide and the toolkit's own source.
• Headings are sentence case per CLAUDE.md, which differs from the older Title Case on the Zendesk and Salesforce pages but matches the newer Cisco Duo page.
• The page has Troubleshooting and Next steps sections that other auth-provider pages don't. That shape comes from the ServiceNow remote-MCP page, so the two ServiceNow pages stay consistent with each other. Happy to trim if you'd rather hold the line on auth-provider page structure.
• One unverified step: setting the provider ID to servicenow. It has to match the toolkit's OAuth2(id="servicenow") declaration, but neither walkthrough surfaced it as a distinct field on the OAuth 2.0 tab. Worth a second pair of eyes from anyone who's configured a custom provider recently.
• Vale: 0 errors. 4 remaining warnings are unavoidable (3 are Vale not recognizing "ServiceNow" as a proper noun, 1 is "Application Registry" as a literal product name).

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only changes with no runtime, auth, or application code impact.

Overview
Adds a ServiceNow auth provider reference at /references/auth-providers/servicenow so customers can wire OAuth for the shipped ServiceNow toolkit (OAuth2(id="servicenow") plus SERVICENOW_INSTANCE_URL). The page walks through creating an OAuth client in ServiceNow (tabs for Machine Identity Console vs Application Registry), setting the instance URL secret, registering a custom OAuth 2.0 provider in Arcade, and using auth from app code, the pre-built MCP server, or custom arcade_mcp_server tools—with emphasis on keeping the useraccount scope and avoiding scope traps on each registration path.

The Connect a ServiceNow Hosted MCP Server guide’s info callout no longer says Arcade lacks a ServiceNow toolkit; it now points readers to the toolkit and this auth page, and still positions MCP Server Console for instance-specific tools.

public/llms.txt is regenerated to list the new auth provider page.

^{Reviewed by Cursor Bugbot for commit cc50cc2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 24, 2026 5:12pm UTC