We have a requirement to validate jwt tokens for inbound webservices:

  • In Salesforce we will expose some REST WS
  • 3rd party system will call salesforce with a jwt token* in the Authorization header

*jwt token already requested following the oauth2 flow from an external idp server.

Any guidance how to do that in Salesforce without changing the flow?

  • 2
    Are you using Oauth2 JWT Flow? if yes then why do you need explicit validation? it will validate the token when you send it to the rest end point?. Is the jwt token provided by salesforce or external IDP?
    – RedDevil
    May 11, 2019 at 7:46
  • The External Idp is providing the JWT Token
    – Akram G
    May 11, 2019 at 13:17

1 Answer 1


You want OAuth 2.0 JWT Bearer Token Flow . In this flow you will exchange the JWT token for oAuth access token. You can then use the access token in Authorization header to call your REST API.

  • The token is provided by external IDP but this oauth flow is for salesforce to exchange JWT for token will that work?
    – RedDevil
    May 11, 2019 at 19:53
  • @RedDevil If the JWT token conforms to SF requirements, then yes. Depends on the IdP capabilities.
    – identigral
    May 12, 2019 at 16:41
  • What is meant by JWT Token conform to SFDC requirement?
    – Akram G
    May 12, 2019 at 17:07
  • @AkramG See the SF doc linked in my answer
    – identigral
    May 12, 2019 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .