This is my first time setting up Named credentials with JWT, and I am a little bit confused. Currently to test the external api I am using postman:

Method:Post: https://api.xxx.com.au/login

"username": "myuser",
"password": "mypasswordabc123"

this returns

    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiO.....",
    "refresh_token": "986db6f83dbc...."

then I can do a normal API using bearer token (the token value) and POST method to https://api.xxxx.com.au/bbb1

the problem that i am facing is, when I am going to create the named creential in salesforce, they are a lot of compulsory fields requested that I cant identify,not sure if this missing in the external doc, or is my unexperience with JWT

Issuer: (Specify who issued the JWT using a case-sensitive string): The external provider should provide me with this information? or is this the login URL? https://api.xxx.com.au/login

Named Principal Subject: (Static text, without quotes, that specifies the JWT's Subject for all token requests) is this the internal user in salesforce who will be doing the API

Audiences: (External Service or other allowed recipients for the JWT. Store each audience as a case-sensitive string on a new line.) Token Valid for (the external resource documentation doesnt say if it actually expires so I guess 1 day is good, and each day will re grab the token)

When I run the following

HttpRequest req = new HttpRequest();
req.setBody('{"value": "myVal"}');
Http http = new Http();
HTTPResponse res = http.send(req);

I get the error, in Named credential JWT there is no option to add the username and password, as I did in postman

{"code":401,"message":"Invalid JWT Token"}

Not sure what I am missing

1 Answer 1


It looks like the JWT is issued by your target service @ https://api.xxx.com.au/login when you send in username/password. JWT feature of Named Credential is to have Salesforce issue JWT, a different use case. The token is signed by a private key so the issuer of the token (Salesforce vs your service) makes a difference, you can't mix and match them.

  • Now i am a bit more confused, I am sorry. I thought the purposed of Named credentials is to be use for callouts to avoid having to add a remote site and to avoid having to use credentials in the code, when you mentioned "is to have Salesforce issue JWT" sounds for me like an inbound request comes into salesforce and salesforce generate the JWT token thourgh the named credential, is that what you meant?
    – manza
    Aug 14, 2019 at 5:26
  • Named Credential is for outbound callouts, you understand correctly..but not just any kind of callout. It works if the target API can accept a JWT signed by Salesforce as a bearer token. Your /bbbb API likely wants a JWT issued by your external service provider's authorization server, this issue happens when you send in your username/password.
    – identigral
    Aug 14, 2019 at 6:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .