I have a requirement where on lead conversion in Salesforce, I need to call a third party API and post converted lead's details to that API. I have covered up til the part where we need to add endpoint of the API in Remote site settings in Salesforce and callout is made successfully. Now comes the tricky party - I had made the sample using a public API but now for development purposes, I need to call my API and use JWT token for authentication and security.

I looked out for this but I am all confused because most of the samples/content correspond to third party applications consuming Salesforce API and using JWT instead of consumer secret and id which isn't quite what I am looking for. I need to call a third party API from Salesforce and that API would need a JWT token from Salesforce for authentication. How can this be achieved? Is there a need to create connected app for this?

I am new to Salesforce and find some concepts confusing so have come to this platform for seeking correct information.

1 Answer 1


A Named Credential can issue a specific type of JWT out of the box (see this answer for more details on how it works)

HttpRequest req = new HttpRequest();
Http http = new Http();
HTTPResponse res = http.send(req);

This will manufacture a JWT with alg set to RS256 and standard claims described in RFC 7519: iss (issuer), aud (audience), sub (subject) and exp (expiration date/time). The values of these claims are statically defined via the Named Credential config screen. RS256 refers to the method of signing the token via RSA public/private keypair and SHA-256 as the hashing function. The other commonly used JWT signing algorithm is HS256, it uses symmetric keys and it's not supported by the Named Credential.

If you need a JWT with non-standard claims or you need more sophistication when generating standard claim values, you can create a JWT in Apex:

Map<String,String> claims = new Map<String,String>();

Auth.JWT jwt = new Auth.JWT();
// add standard claims
// add custom claims
Auth.JWS signedToken = new Auth.JWS(jwt, 'MyKeyPairName');
String serializedToken = signedToken.getCompactSerialization();

The signing algorithm on this token will be RS256. You have to upload or generate a keypair (private/public key) via Certificates and Key Management in the admin console. MyKeyPairName is the value of UniqueName field on the Certificates detail screen. SF will use the private key from the keypair to sign the JWT.

  • Thank you so much for the reply! I have tried your solution but can you please tell me where can I find the JWT token if I try to capture request in fiddler. I actually want to see the token being generated. Your help would be really appreciated. If I check the logs in developer console, then I can see only this information which isn't much helpful: NamedCallout[Name=TestNC, Endpoint=th-apex-http-callout.herokuapp.com, Method=GET, External Credential Type=EXTERNAL, HTTP Header Authorization=Method: Bearer - Authorization Credential Hash: -797856153, Retry on 401=True] Oct 14, 2019 at 19:44
  • System.debug(...) will print the token to the debug logs. You have to turn on debug-level logging to see these log messages.
    – identigral
    Oct 14, 2019 at 21:10
  • Thanks, it worked.. I got bit confused earlier, so wasn't able to spot it. Thanks for the help. Oct 15, 2019 at 11:03
  • The certificate we upload is the certificate of the external service we are calling to, is that accurate?
    – Aryansh04
    Mar 18, 2021 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .