Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
CORS Error "Origin https://<hostname> not found in Access-Control-Allow-Origin header" When Accessing /oauth_token.do on the Instance - Support and Troubleshooting
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • CORS Error "Origin https://<hostname> not found in Access-Control-Allow-Origin header" When Accessing /oauth_token.do on the Instance
KB0685152

CORS Error "Origin https://<hostname> not found in Access-Control-Allow-Origin header" When Accessing /oauth_token.do on the Instance


5560 Views Last updated : Sep 15, 2022 public Copy Permalink
KB Summary by Now Assist

Issue

From a browser you attempt to access a ServiceNow instance at:

 - https://<instance_name>.service-now.com/oauth_token.do 

When doing so the following error is seen at the browser:

 - Origin https://<hostname> not found in Access-Control-Allow-Origin header

You may have gone to the instance and tried to create a CORS (Cross-Origin Resource Sharing) rule at System Web Services -> CORS Rules, but noticed that you can only create a new rule for a REST API.  Certainly /oauth_token.do is not a REST API so there is no way to create a rule for /oauth_token.do.

Cause

CORS is not supported for the call to /oauth_token.do.

This means CORS is only available from REST, i.e. the out-of-the-box REST APIs or scripted REST web services. 

Resolution

Any checking for CORS when calling /oauth_token.do will need to be disabled at the client side.  This can be done by using one of the following options:

  1. Use a proxy or reverse proxy to front the browser making the /oauth_token.do request. The CORS error will be avoided since the proxy/reverse proxy will be in the same domain as the requesting browser.
  2. Disable CORS at the browser as described in the article: How To Bypass CORS Errors On Chrome And Firefox For Testing (not ServiceNow content)

The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.