Generate a JSON Web Token (JWT)

Step: 1 Get the token request endpoint URL

You first need to get the token request endpoint URL.

Step 2: Sign the JWT

In order to sign the JWT, you must use the private key provided when generating the API Token in Intelligence to encode the payload.

Using Python the necessary modules we need are:

import jwt
import requests
import uuid
import time
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend

The Intelligence platform supports the JWT module - jwt 1.3.1

The JWT needs to be generated with specific claims and signed using the RS256 algorithm with your private key.

JWT Claims (payload):
{
   "iss": "your-client-id",
   "aud": "https://idp.intelligence.salesforce.com"",
   "sub": "your-client-id",
   "iat": 1690129371, (time when the token was issued)
   "jti": "45911cd010b846f9810b150c969b0007"
}

"iss" and "sub": Equivalent to the serviceAccountId

"iat": Epoch time in seconds.

"jti": a random UUID without "-".

Example of JWT

# env can be us1 / us2 / eu1 / eu2
app = 'us1'
service_account_id = ''
private_key_str = '''-----BEGIN RSA PRIVATE KEY-----\nMIIEogI....REDACTED.....xweWOhhutft/sA=\n-----END RSA PRIVATE 
KEY-----'''
​
private_key = serialization.load_pem_private_key(
    private_key_str.encode(),
    password=None,
    backend=default_backend()
)
​
private_key_jwk = jwt.jwk_from_pem(private_key_str.encode())
​
payload = {
  "iss": service_account_id,
  "aud": "https://idp.intelligence.salesforce.com"",
  "sub": service_account_id,
  "iat": int(time.time()),
  "jti": str(uuid.uuid4()).replace('-','')
}
​
jwt_object = jwt.JWT()
jwt_token = jwt_object.encode(payload, private_key_jwk, alg='RS256')

Step 3: Use the JWT to obtain a Platform Token

The Token Endpoint is available in the discoveryEndpoint URL obtained from your API client information.

Note The endpoint used in the example of AWS US instance may change.

"token_endpoint": "https://idp.intelligence.salesforce.com/us1/token""

Request structure

[token_endpoint_obtained_from_the_beginning_of_Step_2]?grant_type=client_credentials&client_assertion=[your_signed_jwt_token]&client_id=[your_client_id]&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer

Example Response

{
  "access_token": "eyJraWQ...",
  "expires_in": 300
}