--- schema_version: "1" id: 013bbd4b2accc97dee19da7510188077a1728fc4c5d4060ee45d67b8cbf33783 title: JWTUtil Class collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/apexref/apex_class_Auth_JWTUtil.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm source_site: developer.salesforce.com content_type: documentation content_hash: 5b3e2b5669de2be1e6a3b5ea0bed6dc8f7f77c348bed76e79528f93dc9bc3451 description: Contains methods for validating a JSON Web Token (JWT) from an external identity provider as part of the OAuth 2.0 token exchange flow. Use these methods as part of the validateIncomingToken method in the Auth.Oauth2TokenExchangeHandler class. Generates a DPoP proof JWT from a public-private key pair. Use this method to help you implement the OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) extension. To use this Apex method, the client certificate must be saved in the Certificate and Key Management page in Setup. Parses a JWT from an encoded string into a header, payload, and signature. Use this method to decode the JWT without validating it.Parses and validates the JWT using a certificate saved in Salesforce. The certificate can be self-signed or signed by a certificate authority.Parses and validates the JWT using a public key from the external identity provider.Parses and validates the JWT using a remote JSON Web Key Set (JWKS) endpoint on your external identity provider. --- # JWTUtil Class Contains methods for validating a JSON Web Token (JWT) from an external identity provider as part of the OAuth 2.0 token exchange flow. Use these methods as part of the validateIncomingToken method in the Auth.Oauth2TokenExchangeHandler class. ## Namespace [Auth](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_namespace_Auth.htm "The Auth namespace provides an interface and classes for single sign-on into Salesforce and session security management.") ## Usage See [Token Exchange Handler Validation and Subject Mapping](https://developer.salesforce.com/docs/atlas.en-us.264.0.apexcode.meta/apexcode/token_exchange_handler.htm). If the methods in this class fail, Salesforce returns an Auth.JWTValidationException exception. - **[JWTUtil Methods](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm#apex_Auth_JWTUtil_methods)** ## JWTUtil Methods The following are methods for JWTUtil. - **[generateDPoPProofForToken(httpMethod, httpUri, dpopCert, nonce, token)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm#apex_Auth_JWTUtil_generateDPoPProofForToken)** Generates a DPoP proof JWT from a public-private key pair. Use this method to help you implement the OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) extension. To use this Apex method, the client certificate must be saved in the Certificate and Key Management page in Setup. - **[parseJWTFromStringWithoutValidation(incomingJWT)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm#apex_Auth_JWTUtil_parseJWTFromStringWithoutValidation)** Parses a JWT from an encoded string into a header, payload, and signature. Use this method to decode the JWT without validating it. - **[validateJWTWithCert(incomingJWT, certDeveloperName)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm#apex_Auth_JWTUtil_validateJWTWithCert)** Parses and validates the JWT using a certificate saved in Salesforce. The certificate can be self-signed or signed by a certificate authority. - **[validateJWTWithKey(incomingJWT, publicKey)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm#apex_Auth_JWTUtil_validateJWTWithKey)** Parses and validates the JWT using a public key from the external identity provider. - **[validateJWTWithKeysEndpoint(incomingJWT, keysEndpoint, shouldUseCache)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_JWTUtil.htm#apex_Auth_JWTUtil_validateJWTWithKeysEndpoint)** Parses and validates the JWT using a remote JSON Web Key Set (JWKS) endpoint on your external identity provider. ### generateDPoPProofForToken(httpMethod, httpUri, dpopCert, nonce, token) Generates a DPoP proof JWT from a public-private key pair. Use this method to help you implement the OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) extension. To use this Apex method, the client certificate must be saved in the Certificate and Key Management page in Setup. #### Signature public static String generateDPoPProofForToken(String httpMethod, String httpUri, String dpopCert, String nonce, String token) #### Parameters httpMethod Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The HTTP method, such as POST or GET, of the request that will include the DPoP proof. This value is used for the htm claim in the JWT. httpUri Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The target URI of the request that will include the DPoP proof JWT, such as https://MyCompanyName.my.salesforce.com/services/oauth2/token for a token request. Use your company's My Domain or Experience Cloud site as the base URL. This value is used for the htu claim in the JWT. dpopCert Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The unique name of the client certificate from the Certificate and Key Management page. nonce Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The dpop\_nonce value returned from requests to the token endpoint. Salesforce requires a nonce for every request. This value is used for the nonce claim in the JWT. For initial token requests, where you don't have a nonce yet, use null. token Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The DPoP-bound access token or refresh token for resource requests and refresh token flows. For token requests, use null. For resource requests, Salesforce automatically hashes the token that you provide and stores the value in the ath claim in the JWT. #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") Returns a Base64-encoded DPoP proof JWT. The JWT consists of a header and payload. For a detailed description of all claims, see the DPoP Proof JWTs section in [RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449#name-dpop-proof-jwts). Here's an example header: { "alg": "ES256", "jwk": { "crv": "P-256", "kty": "EC", "x": "vCAiGjuhIeMCTEJq\_N9-oJRjPTRENezkoQ5TBaJtK7Y", "y": "YXWanpPri\_6o2virYzsAfVNZhAW3SQaxFSBcs89BC-Q" }, "typ": "dpop+jwt" } Here's an example payload: { "jti": "uzUwriQThuMBtwG9CSQxHHMY", "htm": "POST", "htu": "https://MyCompany.my.salesforce.com/services/oauth2/userinfo", "iat": 1787773633, "ath": "LT0...", "nonce": "ni4..." } ### parseJWTFromStringWithoutValidation(incomingJWT) Parses a JWT from an encoded string into a header, payload, and signature. Use this method to decode the JWT without validating it. #### Signature public static Auth.JWT parseJWTFromStringWithoutValidation(String incomingJWT) #### Parameters - **incomingJWT**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The JWT from your identity provider. #### Return Value Type:[Auth.JWT](https://developer.salesforce.com/docs/atlas.en-us.264.0.apexref.meta/apexref/apex_class_Auth_JWT.htm) ### validateJWTWithCert(incomingJWT, certDeveloperName) Parses and validates the JWT using a certificate saved in Salesforce. The certificate can be self-signed or signed by a certificate authority. #### Signature public static Auth.JWT validateJWTWithCert(String incomingJWT, String certDeveloperName) #### Parameters - **incomingJWT**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The JWT from your identity provider. - **certDeveloperName**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") A certificate saved in the Certificate and Key Management page in Setup. #### Return Value Type: [Auth.JWT](https://developer.salesforce.com/docs/atlas.en-us.264.0.apexref.meta/apexref/apex_class_Auth_JWT.htm) ### validateJWTWithKey(incomingJWT, publicKey) Parses and validates the JWT using a public key from the external identity provider. #### Signature public static Auth.JWT validateJWTWithKey(String incomingJWT, String publicKey) #### Parameters - **incomingJWT**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The JWT from your identity provider. - **publicKey**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The public key from your identity provider. #### Return Value Type: [Auth.JWT](https://developer.salesforce.com/docs/atlas.en-us.264.0.apexref.meta/apexref/apex_class_Auth_JWT.htm) ### validateJWTWithKeysEndpoint(incomingJWT, keysEndpoint, shouldUseCache) Parses and validates the JWT using a remote JSON Web Key Set (JWKS) endpoint on your external identity provider. #### Signature public static Auth.JWT validateJWTWithKeysEndpoint(String incomingJWT, String keysEndpoint, Boolean shouldUseCache) #### Parameters - **incomingJWT**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The JWT from your identity provider. - **keysEndpoint**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") A URL pointing to a valid JSON Web Key Set (JWKS) endpoint on your identity provider. The JWKS returned by the endpoint must conform to the specification defined in [RFC 7517: JSON Web Key (JWK)](https://datatracker.ietf.org/doc/html/rfc7517 "HTML (New Window)"). To test HTTP callouts to the JWKS endpoint, use the Auth.HttpCalloutMockUtil class. - **shouldUseCache**: Type: [Boolean](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_boolean.htm#apex_methods_system_boolean "Contains methods for the Boolean primitive data type.") Indicates whether the cache is overwritten with the JWKS after validation. If false, the cache is overwritten with the JWKS after each successful JWT validation. If true, the JWKS is cached only if there is no existing JWKS in the cache; if there is a cached JWKS, it isn't overwritten. #### Return Value Type: [Auth.JWT](https://developer.salesforce.com/docs/atlas.en-us.264.0.apexref.meta/apexref/apex_class_Auth_JWT.htm)