Using JWT when calling out from Salesforce to third party API

Question

I have a requirement where on lead conversion in Salesforce, I need to call a third party API and post converted lead's details to that API. I have covered up til the part where we need to add endpoint of the API in Remote site settings in Salesforce and callout is made successfully. Now comes the tricky party - I had made the sample using a public API but now for development purposes, I need to call my API and use JWT token for authentication and security.

I looked out for this but I am all confused because most of the samples/content correspond to third party applications consuming Salesforce API and using JWT instead of consumer secret and id which isn't quite what I am looking for. I need to call a third party API from Salesforce and that API would need a JWT token from Salesforce for authentication. How can this be achieved? Is there a need to create connected app for this?

I am new to Salesforce and find some concepts confusing so have come to this platform for seeking correct information.

Answer 1

A Named Credential can issue a specific type of JWT out of the box (see this answer for more details on how it works)

HttpRequest req = new HttpRequest();
req.setEndpoint('callout:MyJWT/some_path');
req.setMethod('POST');
Http http = new Http();
HTTPResponse res = http.send(req);
System.debug(res.getBody());

This will manufacture a JWT with alg set to RS256 and standard claims described in RFC 7519: iss (issuer), aud (audience), sub (subject) and exp (expiration date/time). The values of these claims are statically defined via the Named Credential config screen. RS256 refers to the method of signing the token via RSA public/private keypair and SHA-256 as the hashing function. The other commonly used JWT signing algorithm is HS256, it uses symmetric keys and it's not supported by the Named Credential.

If you need a JWT with non-standard claims or you need more sophistication when generating standard claim values, you can create a JWT in Apex:

Map<String,String> claims = new Map<String,String>();
claims.put('foo','bar');

Auth.JWT jwt = new Auth.JWT();
// add standard claims
jwt.setIssuer('https://blah.my.salesforce.com');
...
// add custom claims
jwt.setAdditionalClaims(claims);
Auth.JWS signedToken = new Auth.JWS(jwt, 'MyKeyPairName');
String serializedToken = signedToken.getCompactSerialization();
System.debug(serializedToken);

The signing algorithm on this token will be RS256. You have to upload or generate a keypair (private/public key) via Certificates and Key Management in the admin console. MyKeyPairName is the value of UniqueName field on the Certificates detail screen. SF will use the private key from the keypair to sign the JWT.