Configure JWT-secured Authorization Requests (JAR)
JWT-Secured Authorization Requests (JAR) allow OAuth2 authorization request parameters to be packaged into a single JWT request parameter which is then signed for integrity protection.
Prerequisites
Before configuring your application for using JAR, you must generate an RSA key pair.
Configure JAR for an application
You can configure JAR for an application with the Auth0 Dashboard and the Management API.
Use the Auth0 Dashboard to configure your application to use JAR with previously generated RSA keys.
Navigate to Auth0 Dashboard > Applications.
Select the application you want to use with JAR.
Select the Application Settings tab.
In the Authorization Requests section, enable Require JWT-Secured Authorization Requests.
If no credential is assigned and there are credentials available, you will be prompted to assign an existing credential.
You will also have the option to assign a new credential.
Add and assign a new credential by uploading a previously generated RSA key pair. When prompted, enter the following:
Name: a name to identify the credential
Public Key: public key of the X.509 certificate in PEM format
Algorithm: select the JAR signature algorithm
Expiration Date: set the expiration date of the credential
Use the Management API to configure JAR for your application using the signed_request_object
client configuration property. This object property contains the following fields:
required
: forces all authorization requests to the/authorize
and/oauth/par
to use JAR. To learn more, read Authorization Code Flow with JWT-Secured Authorization Requests and Authorization Code Flow with PAR and JAR.credentials
: an array of credential IDs used to verify signatures.
You can configure JAR for a new application or for an existing application via the Management API.
Configure JAR for a new application
When you create a new application, configure JAR by sending a POST request with the signed_request_object
. In that POST request, you can also register the corresponding client credential (i.e. the key PEM):
POST https://{yourTenant}.auth0.com/api/v2/clients
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
"name": "My App using JAR",
"signed_request_object": {
"required": true,
"credentials": [{
"name": "My credential for JAR",
"credential_type": "public_key",
"pem": "[YOUR PEM FILE CONTENT]",
"alg": "RS256"
}]
},
"jwt_configuration": {
"alg": "RS256"
}
}
Was this helpful?
Configure JAR for an existing application
When updating an existing application, you need to explicitly create a client credential first. The following POST request uses your PEM file content to create your client credentials for JAR:
POST https://{yourTenant}.auth0.com/api/v2/clients/{yourClientId}/credentials
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
"name": "My credentials for JAR",
"credential_type": "public_key",
"pem": "[YOUR PEM FILE CONTENT]",
"alg": "RS256"
}
Was this helpful?
Then, assign the client credential to the signed_request_object
client configuration. The following PATCH request associates your client credentials with the signed_request_object
:
PATCH https://{yourTenant}.auth0.com/api/v2/clients/{yourClientId}
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
"signed_request_object": {
"credentials": [{"id": "[YOUR CREDENTIAL ID]"}]
}
}
Was this helpful?