Generating JWT Credentials

You can create OAuth 2.0 client credentials using the JSON Web Token (JWT) grant type to integrate with your third-party applications. This unique grant type allows customers to authenticate applications with Registered Claim Names.

To create the credential

Tip:

For the purpose of demonstrating how to create this credential type, we are choosing Generic as the example system. Other supported systems such as Bigquery, GSuite, or Box can be used as the target system and may populate fields in different orders than show here.

  1. On the Integrations menu, select Credentials.

    The Credentials screen appears.

  2. Click the Add credential button.

    The Select existing system screen appears.

  3. Enter your system in the Select System field, then click the Next button.


    The Enter Credential Details screen appears.

  4. The Enter Credentials Details screen will populate fields relevant to the chosen system's credential options. You can modify the options, as necessary.
  5. Complete the fields, then refer to JWT Claims Reference.

    Click the Save button to create the credential.



    Field
    Description
    Credential Name

    Enter a name for the new credential.

    Application Type

    Choose Web App.

    Authentication Method

    Select OAuth 2.0.

    Grant Type

    Select JSON Web Token (JWT).

    Access Token URL

    Provide your system's Access Token URL.

    Client ID

    Enter the Client ID generated by your system.

    Client Secret

    Enter the Client Secret generated by your system.

    Algorithm

    Select a signature algorithm from the selection field.

    Private Key

    Enter the Private Key generated by your system.

    Assertion Parameter Name

    Enter the name of the desired assertion parameter.

    Authentication Parameters

    Provide key-value pairs for your authentication parameters.

  6. Click the Save button.

JWT Claims Reference



Field
Description
Subject ("sub")

Enter the Subject Claim.

Audience ("aud")

Enter the Audience Claim. Some systems will default to https://oauth2.googleapis.com/token

Issuer ("iss")

Enter the Issuer Claim.

Expiration Time ("exp")

Enter the Expiration Time in seconds. The expiration claim will be calculated as the supplied number of seconds from token creation.

Include Not Before ("nbf")

Enable to include nbf claim set to time stamp of token creation.

Include Issued At ("iat")

Enable to include iat claim set to time stamp of token creation.

Include JWT ID ("jti")

Enable to include jti header set to random GUID on token creation.

Additional Headers

Include any additional headers here in JSON format. The "typ" and "alg" headers are added automatically.

Custom Claims

Enter any custom claims here in JSON format. Do not include any of these seven claims above as they will be dropped from the claims if added here.