--- schema_version: "1" id: cf462c7ce57745f2ecc32d696ca3e438d9154d4ca20ab3330fbe72ced6472f04 title: JWT Class collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/apexref/apex_class_Auth_JWT.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm source_site: developer.salesforce.com content_type: documentation content_hash: 993a2934fbfb7ed11a201c9140e2ee74b11ba3dd5e45d9e21eebc521be239efb description: Generates the JSON Claims Set in a JSON Web Token (JWT). The resulting Base64-encoded payload can be passed as an argument to create an instance of the Auth.JWS class.Makes a duplicate copy of the JWT object.Returns a map of additional claims in the JWT, where the key string contains the name of the claim, and the value contains the value of the claim.Returns the audience (aud) claim that identifies the intended recipients of the JWT.Returns the issuer (iss) claim that identifies the issuer of the JWT.Returns the not before (nbf) claim that identifies the time before which the JWT must not be accepted for processing, while allowing some leeway for clock skew. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. To return the nbf claim for these JWTs, use the getAdditionalClaims method instead.Returns the subject (sub) claim that identifies the current user of the JWT.Returns the length of time (in seconds) that the JWT is valid, which affects the expiration (exp) claim. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. To return the validity length for these JWTs, use the getAdditionalClaims method instead.Sets the additional claims in the JWT. Returned by the getAdditionalClaims method.Sets the audience (aud) claim in the JWT. Returned by the getAud method.Sets the issuer (iss) claim in the JWT. Returned by the getIss method.Sets the not before (nbf) claim in the JWT. Returned by the getNbfClockSkew method. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. For these JWTs, the incoming JWT determines the nbf claim.Sets the subject (sub) claim in the JWT. Returned by the getSub method.Sets the length of time (in seconds) that the JWT is valid, which affects the expiration (exp) claim. Returned by the getValidityLength method. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. For these JWTs, the incoming JWT determines the validity length.Generates the JSON object representation of the Claims Set as an encoded JWT payload. --- # JWT Class Generates the JSON Claims Set in a JSON Web Token (JWT). The resulting Base64-encoded payload can be passed as an argument to create an instance of the Auth.JWS class. ## Namespace [Auth](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_namespace_Auth.htm "The Auth namespace provides an interface and classes for single sign-on into Salesforce and session security management.") ## Usage Use the methods in this class to generate the payload in a JWT bearer token for the OAuth 2.0 JWT bearer token flow. For more information and a full code sample, see [JWTBearerTokenExchange Class](https://developer.salesforce.com/docs/atlas.en-us.264.0.apexref.meta/apexref/apex_class_Auth_JWTBearerTokenExchange.htm). - **[JWT Methods](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_methods)** ## JWT Methods The following are methods for JWT. All are instance methods. - **[clone()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_clone)** Makes a duplicate copy of the JWT object. - **[getAdditionalClaims()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_getAdditionalClaims)** Returns a map of additional claims in the JWT, where the key string contains the name of the claim, and the value contains the value of the claim. - **[getAud()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_getAud)** Returns the audience (aud) claim that identifies the intended recipients of the JWT. - **[getIss()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_getIss)** Returns the issuer (iss) claim that identifies the issuer of the JWT. - **[getNbfClockSkew()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_getNbfClockSkew)** Returns the not before (nbf) claim that identifies the time before which the JWT must not be accepted for processing, while allowing some leeway for clock skew. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. To return the nbf claim for these JWTs, use the getAdditionalClaims method instead. - **[getSub()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_getSub)** Returns the subject (sub) claim that identifies the current user of the JWT. - **[getValidityLength()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_getValidityLength)** Returns the length of time (in seconds) that the JWT is valid, which affects the expiration (exp) claim. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. To return the validity length for these JWTs, use the getAdditionalClaims method instead. - **[setAdditionalClaims(additionalClaims)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_setAdditionalClaims)** Sets the additional claims in the JWT. Returned by the getAdditionalClaims method. - **[setAud(aud)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_setAud)** Sets the audience (aud) claim in the JWT. Returned by the getAud method. - **[setIss(iss)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_setIss)** Sets the issuer (iss) claim in the JWT. Returned by the getIss method. - **[setNbfClockSkew(nbfClockSkew)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_setNbfClockSkew)** Sets the not before (nbf) claim in the JWT. Returned by the getNbfClockSkew method. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. For these JWTs, the incoming JWT determines the nbf claim. - **[setSub(sub)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_setSub)** Sets the subject (sub) claim in the JWT. Returned by the getSub method. - **[setValidityLength(validityLength)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_setValidityLength)** Sets the length of time (in seconds) that the JWT is valid, which affects the expiration (exp) claim. Returned by the getValidityLength method. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. For these JWTs, the incoming JWT determines the validity length. - **[toJSONString()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWT.htm#apex_Auth_JWT_toJSONString)** Generates the JSON object representation of the Claims Set as an encoded JWT payload. ### clone() Makes a duplicate copy of the JWT object. #### Signature public Object clone() #### Return Value Type: [JWT](#apex_class_Auth_JWT "Generates the JSON Claims Set in a JSON Web Token (JWT). The resulting Base64-encoded payload can be passed as an argument to create an instance of the Auth.JWS class.") ### getAdditionalClaims() Returns a map of additional claims in the JWT, where the key string contains the name of the claim, and the value contains the value of the claim. #### Signature public Map getAdditionalClaims() #### Return Value Type: [Map](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_map.htm#apex_methods_system_map "Contains methods for the Map collection type.")<[String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type."),Object> The claims returned depend on how the JWT was generated. If the JWT was generated using other methods in the Auth.JWT class, this method returns the claims that were set using the setAdditionalClaims method. For JWTs generated using methods in the [Auth.JWTUtil](https://developer.salesforce.com/docs/atlas.en-us.264.0.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm) class, the getAdditionalClaims method returns all claims except for these three. - aud (audience)—Use the getAud method instead. - iss (issuer)—Use the getIss method instead. - sub (subject)—Use the getSub method instead. For these JWTs, when the incoming JWT has a claim that stores an inner JSON list, the claim value is returned as a string. ### getAud() Returns the audience (aud) claim that identifies the intended recipients of the JWT. #### Signature public String getAud() #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") ### getIss() Returns the issuer (iss) claim that identifies the issuer of the JWT. #### Signature public String getIss() #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") ### getNbfClockSkew() Returns the not before (nbf) claim that identifies the time before which the JWT must not be accepted for processing, while allowing some leeway for clock skew. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. To return the nbf claim for these JWTs, use the getAdditionalClaims method instead. #### Signature public Integer getNbfClockSkew() #### Return Value Type: [Integer](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_integer.htm#apex_methods_system_integer "Contains methods for the Integer primitive data type.") ### getSub() Returns the subject (sub) claim that identifies the current user of the JWT. #### Signature public String getSub() #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") ### getValidityLength() Returns the length of time (in seconds) that the JWT is valid, which affects the expiration (exp) claim. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. To return the validity length for these JWTs, use the getAdditionalClaims method instead. #### Signature public Integer getValidityLength() #### Return Value Type: [Integer](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_integer.htm#apex_methods_system_integer "Contains methods for the Integer primitive data type.") ### setAdditionalClaims(additionalClaims) Sets the additional claims in the JWT. Returned by the getAdditionalClaims method. #### Signature public void setAdditionalClaims(Map additionalClaims) #### Parameters - **additionalClaims**: Type: [Map](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_map.htm#apex_methods_system_map "Contains methods for the Map collection type.")<[String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type."),Object> #### Return Value Type: void #### Usage Additional claims must not include any standard claims. ### setAud(aud) Sets the audience (aud) claim in the JWT. Returned by the getAud method. #### Signature public void setAud(String aud) #### Parameters - **aud**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") #### Return Value Type: void ### setIss(iss) Sets the issuer (iss) claim in the JWT. Returned by the getIss method. #### Signature public void setIss(String iss) #### Parameters - **iss**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") #### Return Value Type: void ### setNbfClockSkew(nbfClockSkew) Sets the not before (nbf) claim in the JWT. Returned by the getNbfClockSkew method. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. For these JWTs, the incoming JWT determines the nbf claim. #### Signature public void setNbfClockSkew(Integer nbfClockSkew) #### Parameters - **nbfClockSkew**: Type: [Integer](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_integer.htm#apex_methods_system_integer "Contains methods for the Integer primitive data type.") #### Return Value Type: void ### setSub(sub) Sets the subject (sub) claim in the JWT. Returned by the getSub method. #### Signature public void setSub(String sub) #### Parameters - **sub**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") #### Return Value Type: void ### setValidityLength(validityLength) Sets the length of time (in seconds) that the JWT is valid, which affects the expiration (exp) claim. Returned by the getValidityLength method. This method returns a NoAccess exception for JWTs generated using methods in the Auth.JWTUtil class. For these JWTs, the incoming JWT determines the validity length. #### Signature public void setValidityLength(Integer validityLength) #### Parameters - **validityLength**: Type: [Integer](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_integer.htm#apex_methods_system_integer "Contains methods for the Integer primitive data type.") #### Return Value Type: void ### toJSONString() Generates the JSON object representation of the Claims Set as an encoded JWT payload. #### Signature public String toJSONString() #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.")