1

I have a requirement where on lead conversion in Salesforce, I need to call a third party API and post converted lead's details to that API. I have covered up til the part where we need to add endpoint of the API in Remote site settings in Salesforce and callout is made successfully. Now comes the tricky party - I had made the sample using a public API but now for development purposes, I need to call my API and use JWT token for authentication and security.

I looked out for this but I am all confused because most of the samples/content correspond to third party applications consuming Salesforce API and using JWT instead of consumer secret and id which isn't quite what I am looking for. I need to call a third party API from Salesforce and that API would need a JWT token from Salesforce for authentication. How can this be achieved? Is there a need to create connected app for this?

I am new to Salesforce and find some concepts confusing so have come to this platform for seeking correct information.

1

A Named Credential can issue JWTs out of the box (see this answer for more details on how it works)

HttpRequest req = new HttpRequest();
req.setEndpoint('callout:MyJWT/some_path');
req.setMethod('POST');
Http http = new Http();
HTTPResponse res = http.send(req);
System.debug(res.getBody());

This will manufacture a JWT with standard claims described in RFC 7519: iss (issuer), aud (audience), sub (subject) and exp (expiration date/time). The values of these claims are statically defined via the Named Credential config screen.

If you need a JWT with non-standard claims or you need more sophistication when generating standard claim values, you can create a JWT in Apex:

Map<String,String> claims = new Map<String,String>();
claims.put('foo','bar');

Auth.JWT jwt = new Auth.JWT();
// add standard claims
jwt.setIssuer('https://blah.my.salesforce.com');
...
// add custom claims
jwt.setAdditionalClaims(claims);
Auth.JWS signedToken = new Auth.JWS(jwt, 'MyKeyPairName');
String serializedToken = signedToken.getCompactSerialization();
System.debug(serializedToken);

You have to upload or generate a keypair (private/public key) via Certificates and Key Management in the admin console. MyKeyPairName is the value of UniqueName field on the Certificates detail screen. SF will use the private key from the keypair to sign the JWT.

  • Thank you so much for the reply! I have tried your solution but can you please tell me where can I find the JWT token if I try to capture request in fiddler. I actually want to see the token being generated. Your help would be really appreciated. If I check the logs in developer console, then I can see only this information which isn't much helpful: NamedCallout[Name=TestNC, Endpoint=th-apex-http-callout.herokuapp.com, Method=GET, External Credential Type=EXTERNAL, HTTP Header Authorization=Method: Bearer - Authorization Credential Hash: -797856153, Retry on 401=True] – Ashna Arora Oct 14 at 19:44
  • System.debug(...) will print the token to the debug logs. You have to turn on debug-level logging to see these log messages. – identigral Oct 14 at 21:10
  • Thanks, it worked.. I got bit confused earlier, so wasn't able to spot it. Thanks for the help. – Ashna Arora Oct 15 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.