Documentation
Documentation
Step 3: JWT Bearer Grant
Present the ID-JAG to the Authorization Server to obtain an access token for the Resource Server.
What is JWT Bearer Grant?
The JWT Bearer Grant (RFC 7523) allows your application to present a signed JWT assertion (the ID-JAG) to obtain an access token. The Authorization Server validates the assertion and issues an access token that can be used to access protected resources.
When you register a client at Client Registration with a resource connection, a corresponding resource client (e.g., client_xxx-at-todo0) is auto-provisioned at the Authorization Server. Save the resource client credentials from the confirmation modal. They are required for this step.
Request parameters
| Parameter | Required | Value |
|---|---|---|
grant_type | Yes | urn:ietf:params:oauth:grant-type:jwt-bearer |
assertion | Yes | The ID-JAG from Step 2 |
scope | Optional | Requested scopes (must be subset of ID-JAG scopes) |
Implementation
Developer-registered clients use client_secret_post: credentials go in the POST body, not in an Authorization: Basic header. Use the resource client credentials (resource_client_id / resource_client_secret) from your registration, not the IDP client credentials from Steps 1 and 2.
Response
A successful response:
| Field | Description |
|---|---|
access_token | The access token for the Resource Server |
token_type | Always Bearer |
expires_in | Token lifetime in seconds (typically 2 hours) |
scope | Granted scopes |
The access token contains:
iss- Issuer (the Authorization Server)sub- Subject:{providerName}:{userSub}, e.g.customer1:alice@example.com. See Token Structureaud- Audience (the Resource Server URL, with trailing slash)client_id- Your resource client IDscope- Granted permissions (intersection of requested and ID-JAG scopes)exp- Expiration timeiat- Issued at timejti- Unique token identifier
Decoded access token example
Error handling
| Error | Cause | Fix |
|---|---|---|
invalid_grant | ID-JAG is expired, invalid, or signature verification failed | Get a fresh ID-JAG from Step 2; ID-JAGs expire in 5 minutes |
invalid_client | Client authentication failed (wrong credentials) | Use your resource client credentials (resource_client_id / resource_client_secret), not the IDP client credentials |
unauthorized_client | Resource client not registered at Authorization Server | Register via Client Registration with a resource connection |
invalid_scope | Requested scope exceeds what's allowed | Request only scopes that were authorized in the ID-JAG |
Security considerations
- ID-JAG Expiry: ID-JAGs are short-lived (5 minutes). Request access tokens promptly.
- Scope Limitation: The issued scope is the intersection of what you request here and what the ID-JAG authorized in Step 2.
- Client Binding: The access token is bound to your resource client ID (
client_xxx-at-todo0). subformat: Thesubclaim in the access token is{providerName}:{userEmail}, not the raw email. Account for this in your resource server's user identification logic.
Next step
Now that you have an access token, proceed to Step 4: Call the Resource to access protected resources.
On this page