Documentation
Documentation
JWT Bearer Grant
Present the ID-JAG to the Authorization Server to obtain an access token for the Resource Server.
What is JWT Bearer Grant?
The JWT Bearer Grant (RFC 7523) allows your application to present a signed JWT assertion (the ID-JAG) to obtain an access token. The Authorization Server validates the assertion and issues an access token that can be used to access protected resources.
When you register a client at Client Registration with a resource connection, a corresponding resource client (e.g., client_xxx-at-todo0) is auto-provisioned at the Authorization Server. Save the resource client credentials from the confirmation modal. They are required for this step.
Request parameters
| Parameter | Required | Value |
|---|---|---|
grant_type | Yes | urn:ietf:params:oauth:grant-type:jwt-bearer |
assertion | Yes | Your ID-JAG from the previous step |
scope | Optional | Requested scopes (must be subset of ID-JAG scopes) |
Implementation
Developer-registered clients use client_secret_post: credentials go in the POST body, not in an Authorization: Basic header. Use the resource client credentials (resource_client_id / resource_client_secret) from your registration, not the IDP client credentials from Steps 1 and 2.
Response
A successful response:
| Field | Description |
|---|---|
access_token | The access token for the Resource Server |
token_type | Always Bearer |
expires_in | Token lifetime in seconds (typically 2 hours) |
scope | Granted scopes |
The access token contains:
iss- Issuer (the Authorization Server)sub- Subject:{providerName}:{userSub}, e.g.customer1:alice@example.com. See Token Structureaud- Audience (the Resource Server URL, with trailing slash)client_id- Your resource client IDscope- Granted permissions (intersection of requested and ID-JAG scopes)exp- Expiration timeiat- Issued at timejti- Unique token identifier
Decoded access token example
Error handling
| Error | Cause | Fix |
|---|---|---|
invalid_grant | ID-JAG is expired, invalid, or signature verification failed | Get a fresh ID-JAG from the previous step; ID-JAGs expire in 5 minutes |
invalid_client | Client authentication failed (wrong credentials) | Use your resource client credentials (resource_client_id / resource_client_secret), not the IDP client credentials |
unauthorized_client | Resource client not registered at Authorization Server | Register via Client Registration with a resource connection |
invalid_scope | Requested scope exceeds what's allowed | Request only scopes that were authorized in the ID-JAG |
Security considerations
- ID-JAG Expiry: ID-JAGs are short-lived (5 minutes). Request access tokens promptly.
- Scope Limitation: The issued scope is the intersection of what you request here and what the ID-JAG authorized when it was issued.
- Client Binding: The access token is bound to your resource client ID (
client_xxx-at-todo0). subformat: Thesubclaim in the access token is{providerName}:{userEmail}, not the raw email. Account for this in your resource server's user identification logic.
Next step
Now that you have an access token, proceed to Call the Resource to access protected resources.
On this page