JWT Authentication

Webex Connect supports the use of JWT within the Core SDK and Thread, Topic and Segment APIs. JWT provides additional security by providing a mechanism to restrict resource access to authorized users.

For detailed information on JWT, visit jwt.io.

Note that Webex Connect only currently supports the SHA256 algorithm which uses a pre-shared secret key. The key is configured during creation of a mobile/web app asset within the Webex Connect platform.

📘

Enabling JWT Authentication for Thread, Topic, and Segment APIs

As a security best practice, we recommend that you enable JWT authentication. It is an optional feature and is not enabled by default. Please send an email to the support team to enable JWT authentication for Thread, Topic, and Segment APIs for your tenant if you'd like to use it. Once it's been enabled by the Support team, you will need to enable the JWT authentication option on the mobile/web app asset configuration page.

Token Format.

JWT Token Header

The following table lists the supported header attributes:

Example Token Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Token Payload

The following table lists the JWT claims which are supported within the token payload:

Example Payload

{
  "exp": 1584525821,
  "appId": "TR21063826",
  "userId": "67deb017-5038-4832-a6b9-aa7e00987b6f"
}

JWT Token Signature

The following example demonstrates how a signature is generated:

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

Sample JWT token

🚧

NOTE

• The secret key must be base64 encoded before entering in the app asset configuration page.
• The length of the secret key before encoding must be at least 256 bits (32 bytes).

JWT validation errors

If an SDK method call fails because of a JWT validation error then an exception is generated with one of the following error codes: