@@ -23,8 +23,10 @@ import {
   CLIENT_CREDENTIALS_AUTH_METHOD,
   getTokenServiceAccountErrorMessage,
   isTokenServiceAccountFieldRequired,
+  type TokenServiceAccountAuthMethod,
   type TokenServiceAccountDescriptor,
   type TokenServiceAccountField,
+  tokenFieldBelongsToAuthMethod,
 } from '@/lib/credentials/token-service-accounts/descriptors'
 import { ClientCredentialsFields } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credentials-fields'
 import { withBrandIcon } from '@/blocks/brand-icon'
@@ -42,8 +44,6 @@ function normalizeDomainInput(raw: string): string {
     .replace(/[/?#].*$/, '')
 }
 
-type TokenAuthMethod = 'token' | typeof CLIENT_CREDENTIALS_AUTH_METHOD
-
 function openDocs(url: string): void {
   window.open(url, '_blank', 'noopener,noreferrer')
 }
@@ -101,25 +101,30 @@ function TokenServiceAccountModalForm({
   submitPending,
 }: TokenServiceAccountModalProps) {
   const clientCredentials = descriptor.clientCredentials
-  const [selectedAuthMethod, setSelectedAuthMethod] = useState<TokenAuthMethod | null>(null)
+  const [selectedAuthMethod, setSelectedAuthMethod] =
+    useState<TokenServiceAccountAuthMethod | null>(null)
   /**
    * A reconnect cannot pre-select the mode: the stored one lives inside the encrypted secret and
    * is never returned to the client, so the admin restates it while retyping the secret. Until
    * then neither mode's fields show, so a reconnect never switches modes by default.
    */
   const mustRestateAuthMethod = Boolean(clientCredentials && credentialId && !selectedAuthMethod)
-  const authMethod: TokenAuthMethod | null =
+  const authMethod: TokenServiceAccountAuthMethod | null =
     selectedAuthMethod ??
     (mustRestateAuthMethod
       ? null
       : clientCredentials?.preferred
         ? CLIENT_CREDENTIALS_AUTH_METHOD
         : 'token')
   const usesClientCredentials = authMethod === CLIENT_CREDENTIALS_AUTH_METHOD
-  /** A field of the pasted-token sign-in only (ServiceNow's username) shows once that mode is chosen. */
+  /** A field that belongs to one sign-in mode (ServiceNow's username) shows once that mode is chosen. */
   const shownField = (id: TokenServiceAccountField['id']) =>
     descriptor.fields.find(
-      (field) => field.id === id && !(field.pastedTokenOnly && authMethod !== 'token')
+      (field) =>
+        field.id === id &&
+        (authMethod
+          ? tokenFieldBelongsToAuthMethod(field, authMethod)
+          : !field.requiredForAuthMethods)
     )
   const tokenField = descriptor.fields.find((field) => field.id === 'apiToken')
   const domainField = shownField('domain')
@@ -278,7 +283,7 @@ function TokenServiceAccountModalForm({
             title='Authentication'
             value={authMethod ?? undefined}
             onChange={(value) => {
-              setSelectedAuthMethod(value as TokenAuthMethod)
+              setSelectedAuthMethod(value as TokenServiceAccountAuthMethod)
               if (error) setError(null)
             }}
             options={[
 
@@ -199,6 +199,23 @@ describe('v2 credential provider catalog contract', () => {
     expect(configuration?.hint).not.toContain('Keyless')
   })
 
+  it('tells headless clients the ServiceNow username belongs to the password sign-in only', async () => {
+    const providers = await listProviders('servicenow')
+    const servicenow = providers.find(
+      (provider) =>
+        provider.type === 'service_account' && provider.providerId === 'servicenow-service-account'
+    )
+
+    expect(responseSchema.safeParse({ data: providers, nextCursor: null }).success).toBe(true)
+    expect(servicenow?.fields.find((field) => field.id === 'providerWorkspaceId')).toMatchObject({
+      required: true,
+      requiredForAuthMethods: ['token'],
+    })
+    expect(
+      servicenow?.fields.find((field) => field.id === 'domain')?.requiredForAuthMethods
+    ).toBeUndefined()
+  })
+
   it('lists the native Claude Platform provider when filtered', async () => {
     const providers = await listProviders('claude')
 
 
@@ -651,9 +651,7 @@ async function buildTokenClientCredentialSecret(
   }
   const clientId = fields.clientId?.trim()
   const clientSecret = fields.clientSecret?.trim()
-  const domainField = descriptor.fields.find(
-    (field) => field.id === 'domain' && !field.pastedTokenOnly
-  )
+  const domainField = descriptor.fields.find((field) => field.id === 'domain')
   const domain = fields.domain?.trim() || domainField?.defaultValue
   const requiresDomain = Boolean(domainField)
   if (!clientId || !clientSecret || (requiresDomain && !domain)) {
 
@@ -42,10 +42,12 @@ export interface TokenServiceAccountField {
    */
   url?: boolean
   /**
-   * Belongs to the pasted-token sign-in only (ServiceNow's username, which a minted token replaces):
-   * the client-credentials mode neither shows, requires, nor stores it.
+   * Auth methods this field belongs to, for a provider that also offers client credentials:
+   * `token` is the pasted-token sign-in and `client_credentials` the grant. A mode not listed
+   * neither shows, requires, nor stores it (ServiceNow's username, which a minted token replaces).
+   * Absent means the field belongs to every mode.
    */
-  pastedTokenOnly?: boolean
+  requiredForAuthMethods?: readonly TokenServiceAccountAuthMethod[]
   /** Soft-format hint shown while the current value doesn't match `hintPattern`. */
   hintPattern?: RegExp
   hintMessage?: string
@@ -131,6 +133,17 @@ interface TokenServiceAccountClientCredentials {
 /** `authMethod` value selecting the client-credentials mode of a provider whose default is a pasted token (a token provider, or the Atlassian service account). */
 export const CLIENT_CREDENTIALS_AUTH_METHOD = 'client_credentials' as const
 
+/** A token provider's sign-in modes: the pasted token (the default) or its client-credentials grant. */
+export type TokenServiceAccountAuthMethod = 'token' | typeof CLIENT_CREDENTIALS_AUTH_METHOD
+
+/** Whether a descriptor field belongs to the given sign-in mode. */
+export function tokenFieldBelongsToAuthMethod(
+  field: Pick<TokenServiceAccountField, 'requiredForAuthMethods'>,
+  authMethod: TokenServiceAccountAuthMethod
+): boolean {
+  return !field.requiredForAuthMethods || field.requiredForAuthMethods.includes(authMethod)
+}
+
 export const HUBSPOT_SERVICE_ACCOUNT_PROVIDER_ID = 'hubspot-service-account' as const
 export const AIRTABLE_SERVICE_ACCOUNT_PROVIDER_ID = 'airtable-service-account' as const
 export const NOTION_SERVICE_ACCOUNT_PROVIDER_ID = 'notion-service-account' as const
@@ -2597,7 +2610,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Username',
         placeholder: 'Enter the ServiceNow username',
         secret: false,
-        pastedTokenOnly: true,
+        requiredForAuthMethods: ['token'],
       },
       {
         id: 'domain',
@@ -2631,7 +2644,7 @@ export function isTokenServiceAccountFieldRequired(field: TokenServiceAccountFie
 /**
  * Required contract fields per token provider in client-credentials mode: the client ID and
  * secret replace the token, and every other descriptor field without a default (a store
- * domain) stays required unless it belongs to the pasted-token sign-in only.
+ * domain) stays required unless it belongs only to the pasted-token sign-in.
  */
 export const TOKEN_SERVICE_ACCOUNT_CLIENT_CREDENTIAL_FIELDS: Record<
   string,
@@ -2646,7 +2659,7 @@ export const TOKEN_SERVICE_ACCOUNT_CLIENT_CREDENTIAL_FIELDS: Record<
         'clientSecret',
         ...descriptor.fields.flatMap((field) =>
           field.id === 'apiToken' ||
-          field.pastedTokenOnly ||
+          !tokenFieldBelongsToAuthMethod(field, CLIENT_CREDENTIALS_AUTH_METHOD) ||
           !isTokenServiceAccountFieldRequired(field)
             ? []
             : [field.id]