JWT Authentication
Symmetric vs. Asymmetric JWT Authentication
Webex Connect supports JWT-based authentication for Mobile/Web app assets. The main difference between symmetric and asymmetric JWT authentication is how the JWT is signed and how Webex Connect validates the signature.
Summary
| Area | Symmetric JWT | Asymmetric JWT |
|---|---|---|
| Key model | Uses one shared secret. | Uses a public/private key pair. |
| Who signs the customer JWT | Customer backend. | Customer backend. |
| Signing key | Shared secret configured for the app asset. | Customer private key. |
| Verification key | Same shared secret. | Customer public key uploaded in the app asset page. |
| What customer uploads/configures in Connect | Shared secret or symmetric JWT configuration. | Public key/JWK. |
| What customer must protect | Shared secret. | Private key. |
| Does Webex Connect know the signing secret? | Yes, Webex Connect needs the shared secret to validate the JWT. | No, Webex Connect only has the public key. |
| Recommended for | Simpler setups where shared-secret management is acceptable. | Stronger key separation, enterprise security controls, and safer rotation. |
| Key rotation | Replace the shared secret and update signing logic. | Generate a new key pair, upload the new public key, and sign with the new private key. |
| Risk if Connect-side config is exposed | Shared secret exposure can allow token signing. | Public key exposure does not allow token signing. |
Types of Authentications
Updated 24 days ago