Named credential: How do I set up JWT

Question

This is my first time setting up Named credentials with JWT, and I am a little bit confused. Currently to test the external api I am using postman:

Method:Post: https://api.xxx.com.au/login

{
"username": "myuser",
"password": "mypasswordabc123"
}

this returns

{
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiO.....",
    "refresh_token": "986db6f83dbc...."
}

then I can do a normal API using bearer token (the token value) and POST method to https://api.xxxx.com.au/bbb1

the problem that i am facing is, when I am going to create the named creential in salesforce, they are a lot of compulsory fields requested that I cant identify,not sure if this missing in the external doc, or is my unexperience with JWT

Issuer: (Specify who issued the JWT using a case-sensitive string): The external provider should provide me with this information? or is this the login URL? https://api.xxx.com.au/login

Named Principal Subject: (Static text, without quotes, that specifies the JWT's Subject for all token requests) is this the internal user in salesforce who will be doing the API

Audiences: (External Service or other allowed recipients for the JWT. Store each audience as a case-sensitive string on a new line.) Token Valid for (the external resource documentation doesnt say if it actually expires so I guess 1 day is good, and each day will re grab the token)

When I run the following

HttpRequest req = new HttpRequest();
req.setEndpoint('callout:NewCredential_JWT/bbb1');
req.setMethod('POST');
req.setBody('{"value": "myVal"}');
Http http = new Http();
HTTPResponse res = http.send(req);
System.debug(res.getBody());

I get the error, in Named credential JWT there is no option to add the username and password, as I did in postman

{"code":401,"message":"Invalid JWT Token"}

Not sure what I am missing

Answer 1

It looks like the JWT is issued by your target service @ https://api.xxx.com.au/login when you send in username/password. JWT feature of Named Credential is to have Salesforce issue JWT, a different use case. The token is signed by a private key so the issuer of the token (Salesforce vs your service) makes a difference, you can't mix and match them.