I've looked into this a little bit as well, and it's based off the types of ServiceNow Oauth options, and the one that was chosen for this integration. Hope this helps too:
Extract below is from this article: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1647747
Resource owner password credentials Grant Type:
The Resource Owner Password Credentials grant type is designed for obtaining access tokens directly in exchange for a username and password.
In this grant type, the client application makes a POST call to the token endpoint/server to obtain the access token and refresh token. During this process, the client application needs to pass the username and password. Upon reviewing the credentials and client ID/secret, the token provider responds with both an access token and a refresh token.
Request:
POST (Token Endpoint)
Body
grant_type:password
username:{USERNAME}
password:{PASSWORD}
client_id:{CLIENT ID}
client_secret:{CLIENT SECRET}
Note: The client ID and client secret can be sent either in the request body or in the request headers, depending on the configuration.
Response:
{"access_token":"{ACCESS TOKEN}","refresh_token":"{REFRESH TOKEN}","scope":"scope","token_type":"Bearer","expires_in":"Lifetime in seconds"}
------------------------------
Peter Stoltenberg
TTEC Digital
------------------------------