Collection Points with Data Subject Authentication

The standard model for generating consent receipts by making POST calls to /request/v1/consentreceipts relies on the presence of a valid Collection Point JSON Web Token (JWT) in the POST payload. However, OneTrust also supports allowing consent receipts to be created only when the data subject identity has been authenticated, such as by logging in to a site or application.

For the latter circumstance, OneTrust supports sending an additional data subject specific authorization token as a JWT passed in the header of the request, which is signed with a private key or secret. In addition, the corresponding public key will need to be provided to OneTrust to enable validation for the request before issuing the receipt.

By generating and sending the JWT, which also includes the data subject identifier, the application demonstrates that the data subject identity is authentic. Therefore, the Collection Point can be set up to create consent records only if a valid JWT is provided.

Note:

You can set up a Web Form Collection Point to require authentication, but the SDK does not support it, so you must use the API calls instead. However, the Web Form Preview allows you to input an authentication token to support testing.

Step 1: Add a Public Key or JSON Web Key Sets URL

In the OneTrust application, you can select whether to store the public key sent in the authorization token in the application or to store a JSON Web Key Sets (JWKS) URL to verify JWT keys. If storing a public key, see Method 1. If storing a JWKS URL, see Method 2.

Method 1: Add a Public Key in Global Settings

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Consent > Public Keys. The Public Keys screen appears.

  3. Click the Add Public Key button. The Add Public Key modal appears.



  4. In the Name field, enter a name to identify the public key.

  5. In the Public Key field, enter the public key that the authorization will be verified against.

  6. In the Supported Algorithms field, select the supported encryption algorithm for the public key.

  7. In the Key ID field, enter a key ID to be used for verification purposes. This field is optional if you are only using one key or if you are using the default key.

  8. Click the Save button.

Method 2: Add a JWKS URL in Global Settings

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Consent > Public Keys. The Public Keys screen appears.

  3. Enable the Enable JWKS URL Storage setting. The JSON Web Key Sets field appears.



  4. Click the Edit button and enter a JWKS URL from which public keys will be fetched.

  5. Click the Submit button. A confirmation message will appear if the JWKS URL is successfully validated.

Step 2: Turn on Require Authentication for the Collection Point

  1. Navigate to the Universal Consent & Preference Management module.

  2. On the Universal Consent & Preference Management menu, select Interfaces > Collection Points. The Collection Points screen appears.

  3. Click the link in the Name column for the Collection Point for which you want to require authentication. The Collection Point Details screen appears.

  4. Navigate to the Settings tab and enable the Require Authentication on this Collection Point setting. Any new receipts for that version of the Collection Point will now need to be authenticated.

    Note:

    The default public key cannot be deleted if any Draft or Active Collection Point has this setting enabled.

Step 3: Use the Authentication Key

  1. Create a bearer token that includes the Key ID for the respective public key within the header and the data subject identifier in the payload. You can also add an optional expiration date.

  2. Add the key "authorization" as a header in your POST calls to the Consent Receipt API. Then add a valid bearer token.

    Header

    Explanation

    Example

    authorization

    The value must include the type “Bearer” and a signed JWT that can be verified with the Public Key saved in step 3. The value should also include a "sub" claim where the value matches the identifier value in the body of the POST.

    Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

  3. Make the POST call to /request/v1/consentreceipts.

    Note:

    For more information, see Implementing the Collection Point with REST API.

Processing the request

When the POST call is made using the procedure above, OneTrust will only generate a receipt and process the request if all of the following requirements are met:

  1. "Authorization" key is present in the header.

  2. Authorization header contains a valid JWT.

  3. "kid" is included if verification is against a key other than the default.

  4. "sub" claim matches the data subject identifier.

  5. JWT is not expired, if an expiration date was defined.

  6. Signature validates against the saved Public Key.