---
schema_version: "1"
id: 9fa24ece761bd72022a4ee7b18fb1deff89fa9c326c78198bd924698b0736315
title: Generate a JSON Web Token (JWT)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/dato_getstarted_token_api_jwt.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.dato_getstarted_token_api_jwt.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 331b45a3db747ff265f39989b68b64451c6c51aca9f0806d95f516ff40b69fbd
description: To obtain an access token, you need to generate a JWT with specific claims, and sign it using the RS256 algorithm with your private key.
products:
  - Marketing
  - Marketing Cloud Intelligence
release: "264"
---
# Generate a JSON Web Token (JWT)

To obtain an access token, you need to generate a JWT with specific claims, and sign it using the RS256 algorithm with your private key.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d84749e38">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d84749e38 ">To generate an API token:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d84749e38 ">User with Enable API Access</td>

          </tr>
        </tbody>
      </table>

**Step: 1 Get the token request endpoint URL**

You first need to get the token request endpoint URL.

1. Insert the discoveryEndpoint URL you obtained when generating the API token in Intelligence into your browser’s search bar.
2. Press **Enter**.
3. Copy the returned value for the field “token\_endpoint”.
    
    Example for AWS US (aka US1):

![Example](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-salesforce_datorama-264-0-0-production-enus/d38a342d-dd4a-4af8-8343-f372280a75dd/images/icon_example.png)

Example

```
"token_endpoint": "https://idp.intelligence.salesforce.com/us1/token"
```

**Step 2: Sign the JWT**

In order to sign the JWT, you must use the private key provided when generating the API Token in Intelligence to encode the payload.

Using Python the necessary modules we need are:

```
import jwt
import requests
import uuid
import time
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
```

The Intelligence platform supports the JWT module - jwt 1.3.1

The JWT needs to be generated with specific claims and signed using the RS256 algorithm with your private key.

```
JWT Claims (payload):
{
   "iss": "your-client-id",
   "aud": "https://idp.intelligence.salesforce.com"",
   "sub": "your-client-id",
   "iat": 1690129371, (time when the token was issued)
   "jti": "45911cd010b846f9810b150c969b0007"
}
```

"iss" and "sub": Equivalent to the serviceAccountId

"iat": Epoch time in seconds.

"jti": a random UUID without "-".

Example of JWT

```
# env can be us1 / us2 / eu1 / eu2
app = 'us1'
service_account_id = ''
private_key_str = '''-----BEGIN RSA PRIVATE KEY-----\nMIIEogI....REDACTED.....xweWOhhutft/sA=\n-----END RSA PRIVATE 
KEY-----'''
​
private_key = serialization.load_pem_private_key(
    private_key_str.encode(),
    password=None,
    backend=default_backend()
)
​
private_key_jwk = jwt.jwk_from_pem(private_key_str.encode())
​
payload = {
  "iss": service_account_id,
  "aud": "https://idp.intelligence.salesforce.com"",
  "sub": service_account_id,
  "iat": int(time.time()),
  "jti": str(uuid.uuid4()).replace('-','')
}
​
jwt_object = jwt.JWT()
jwt_token = jwt_object.encode(payload, private_key_jwk, alg='RS256')

```

**Step 3: Use the JWT to obtain a Platform Token**

The Token Endpoint is available in the discoveryEndpoint URL obtained from your API client information.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-salesforce_datorama-264-0-0-production-enus/d38a342d-dd4a-4af8-8343-f372280a75dd/images/icon_note.png)

Note The endpoint used in the example of AWS US instance may change.

`"token_endpoint": "https://idp.intelligence.salesforce.com/us1/token""`

Request Parameters   
| Parameter | Type | Description |
| --- | --- | --- |
| client\_id | string | Your client ID (serviceAccountId). |
| client\_assertion | string | Your JWT |
| client\_assertion\_type | string | The type of client assertion. (Fixed value: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer') |
| grant\_type | string | The grant type. (Fixed value: 'client\_credentials') |

Request structure

`[token_endpoint_obtained_from_the_beginning_of_Step_2]?grant_type=client_credentials&client_assertion=[your_signed_jwt_token]&client_id=[your_client_id]&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`

Example Response

```
{
  "access_token": "eyJraWQ...",
  "expires_in": 300
}
```

- “access\_token”—The issued access token you use to make API calls.
- “expires\_in”—The access token life time is 5 minutes (300 seconds).