---
schema_version: "1"
id: 9e74be708b77edd70e1d467f42fd4522debf8874d43896663fa3a61556021879
title: GetJWT()
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/marketing-cloud/ampscript/references/encryption/mc-ampscript-reference-encryption-get-jwt.md
canonical_url: https://developer.salesforce.com/docs/marketing/marketing-cloud-ampscript/references/mc-ampscript-encryption/mc-ampscript-reference-encryption-get-jwt.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 473926a7007bced808dda3c3259ed36a285a34a9b2c1353a95bf40cdec3313ed
products:
  - AMPscript for Marketing Cloud
  - Marketing Cloud
---
# GetJWT()

Creates a JSON Web Token (JWT) for a JSON payload.

JWTs offer a method of securely transmitting information between parties as a JSON object. The information is digitally signed using cryptographic algorithms. Because the JWT is signed, parties that receive a JWT can be assured that the data wasn’t tampered with in transit.

**important:** We recommend that you use the companion function [GetJWTByKeyName()](https://developer.salesforce.com/docs/marketing/marketing-cloud-ampscript/references/mc-ampscript-encryption/mc-ampscript-reference-encryption-get-jwt-by-key-name.md) instead of `GetJWT()`. The difference between `GetJWTByKeyName()` and `GetJWT()` is the first parameter. In the `GetJWT()` function, you pass your secret as the first parameter in plain text. With `GetJWTByKeyName()`, you pass a reference to a key that’s stored using the [Key Management](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm) feature of Marketing Cloud Engagement. With Key Management, you can also control which users have access to your keys. These factors make the `GetJWTByKeyName()` function more secure for most use cases.

## Availability

<table>
  <tr>
    <td>Marketing Cloud Engagement</td>
    <td>✅ Yes</td>
  </tr>
  <tr>
    <td>Marketing Cloud Next</td>
    <td>❌ No</td>
  </tr>
</table>

## Syntax

The `GetJWT()` function uses this syntax: `GetJWT({secret}, {algorithm}, {jsonPayload})`

The function has the parameters listed in this table.

| Name          | Type   | Description                                                                                                                                                                                                                 |
| ------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `secret`      | String | Required. A secret used to sign the JWT.                                                                                                                                                                                    |
| `algorithm`   | String | Required. The hash algorithm to use to encode the JWT. Possible values: <ul><li>`HS256`—HMAC secret with SHA-256 hash</li><li>`HS384`—HMAC secret with SHA-384 hash</li><li>`HS512`—HMAC secret with SHA-512 hash</li></ul> |
| `jsonPayload` | String | Required. The payload of the JWT. Typically, the payload is a JSON object with name-value pairs. The JWT payload isn’t encrypted.                                                                                           |

## Usage

To use the function, provide a signing secret, and specify the encoding algorithm. Finally, provide the payload that you want to encode.

```
%%[
To use the function, provide a signing secret, and specify the encoding algorithm. Lastly, provide the payload that you want to encode.
  Var @JSON
  Var @HREF

  Set @JSON = '{
    "first_name": "Tomás",
    "last_name": "Santos",
    "email": "tomas.santos@example.com",
    "campaign_id": "928384"
  }'
  Set @JWT = GetJWT("0123456789abcdef0123456789abcdef", "HS256", @JSON)
  Set @HREF = CONCAT("https://www.example.com?sign=",@JWT)
]%%

<p>%%=v(@HREF)=%%</p>
```

The function outputs a JWT.

<!-- This JWT contains fictitious data and doesn't present a security risk. -->

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdF9uYW1lIjoiVG9tw6FzIiwibGFzdF9uYW1
lIjoiU2FudG9zIiwiZW1haWwiOiJ0b21hcy5zYW50b3NAZXhhbXBsZS5jb20iLCJjYW1wYWlnbl9pZCI
6IjkyODM4NCJ9.EDh9eRIiFCndRAFcup4R2VktJJXA90Ms4M3rRL5FfZk
```

If the syntax for the function is invalid, the function returns an `InvalidFunctionException` error. If the function call is invalid—for example, if it has an invalid parameter value—it returns a `FunctionExecutionException` error.