--- schema_version: "1" id: a9cae75e66fa561f29c41f07849ad0d3e5afec0007b4203f59ccb83b9254a0e8 title: JweToken Class collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/apexref/apex_class_System_JweToken.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm source_site: developer.salesforce.com content_type: documentation content_hash: 79c35bcb7765e9a47428b49f438d6bc908b31bce917e2ac4ff8251b88c001d89 description: "Represents a parsed JWE (JSON Web Encryption) token in the compact serialization form defined by RFC 7516. A JweToken holds the components needed for decryption: protected header, ephemeral public key, wrapped content encryption key, initialization vector, ciphertext, authentication tag, and Additional Authenticated Data (AAD). Creates a new JweToken from the parsed components of a JWE compact serialization token. This constructor is typically invoked internally after Crypto.parseJwe(Blob) has decomposed the token.Returns the Additional Authenticated Data (AAD) associated with the JWE token. Per RFC 7516 §5.1 step 14, the AAD is the US-ASCII byte encoding of the base64url-encoded JWE protected header. This value is bound to the ciphertext by the AEAD algorithm and must match at decryption time. Returns the key management algorithm from the JWE protected header. This is the alg value that governs how the content encryption key (CEK) is protected. Returns the encrypted content of the JWE — the fourth component of the compact serialization (before the authentication tag).Returns the wrapped content encryption key (CEK), the second component of the JWE compact serialization. This value is decrypted using the recipient's key management key (per getAlgorithm()) to recover the CEK, which is then used to decrypt getCiphertext(). Returns the content encryption algorithm from the JWE protected header. This is the enc value that governs how the payload is encrypted.Returns the ephemeral public key from the JWE protected header (the epk JWK). The key is returned in X.509 SubjectPublicKeyInfo DER encoding, suitable for passing to standard key deserialization utilities.Returns the initialization vector used for content decryption — the third component of the JWE compact serialization.Returns the authentication tag — the fifth and final component of the JWE compact serialization. The tag is used by the AEAD algorithm to detect tampering with the ciphertext or AAD.Returns a string representation of the token suitable for debugging and logging. The output contains only metadata (algorithm identifiers and byte lengths) and never exposes the ephemeral public key, wrapped CEK, ciphertext, or authentication tag." --- # JweToken Class Represents a parsed JWE (JSON Web Encryption) token in the compact serialization form defined by RFC 7516. A JweToken holds the components needed for decryption: protected header, ephemeral public key, wrapped content encryption key, initialization vector, ciphertext, authentication tag, and Additional Authenticated Data (AAD). ## Namespace [System](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_namespace_System.htm "The System namespace provides classes and methods for core Apex functionality.") ## Usage Use JweToken when you need programmatic access to the individual components of a JWE compact serialization token. For example, to inspect the algorithm used, verify the ephemeral public key, or route decryption based on the enc header. The typical flow is: parseJwe → inspect the header via getAlgorithm() / getEncryptionAlgorithm() → call Crypto.decrypt(...) with the extracted components. Crypto.parseJwe(Blob) produces an instance. The caller then passes the extracted components to the nine-argument Crypto.decrypt(...) overload to complete the two-step JWE decryption flow. JweToken is immutable. All fields are set at construction and exposed only through read-only accessors. ## Example // Parse a JWE compact serialization token received from an external service. Blob jweCompact = Blob.valueOf(response.getBody()); JweToken token = Crypto.parseJwe(jweCompact); System.debug('Key management algorithm: ' + token.getAlgorithm()); // e.g. ECDH-ES+A128KW System.debug('Content encryption algorithm: ' + token.getEncryptionAlgorithm()); // e.g. A128GCM System.debug('IV length: ' + token.getIv().size()); // 12 for GCM, 16 for CBC // Decrypt using the recipient's EC private key (PKCS#8 DER) plus the components // carried by the token. This performs ECDH-ES key agreement, Concat KDF, // AES Key Unwrap, and content decryption. Blob plaintext = Crypto.decrypt( token.getAlgorithm(), token.getEncryptionAlgorithm(), recipientPrivateKey, token.getEphemeralPublicKey(), token.getEncryptedKey(), token.getIv(), token.getCiphertext(), token.getTag(), token.getAad() ); - **[JweToken Constructors](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_constructors)** - **[JweToken Methods](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_methods)** ## JweToken Constructors The following are constructors for JweToken. - **[JweToken(alg, enc, epk, encrypted\_key, iv, ciphertext, tag, aad)](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_ctor)** Creates a new JweToken from the parsed components of a JWE compact serialization token. This constructor is typically invoked internally after Crypto.parseJwe(Blob) has decomposed the token. ### JweToken(alg, enc, epk, encrypted\_key, iv, ciphertext, tag, aad) Creates a new JweToken from the parsed components of a JWE compact serialization token. This constructor is typically invoked internally after Crypto.parseJwe(Blob) has decomposed the token. #### Signature public JweToken(String alg, String enc, Blob epk, Blob encrypted\_key, Blob iv, Blob ciphertext, Blob tag, Blob aad) #### Parameters - **alg**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.")Key management algorithm from the JWE protected header (alg field). For example, ECDH-ES+A128KW. - **enc**: Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") Content encryption algorithm from the JWE protected header (enc field). For example, A128GCM or A256CBC-HS512. - **epk**: Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") Ephemeral public key from the JWE protected header (epk JWK), encoded as X.509 SubjectPublicKeyInfo DER bytes. - **encrypted\_key**: Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") Encrypted content encryption key (wrapped CEK) — part 2 of the compact serialization. - **iv**: Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") Initialization vector for content decryption — part 3 of the compact serialization. - **ciphertext**: Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") Encrypted content — part 4 of the compact serialization. - **tag**: Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") Authentication tag — part 5 of the compact serialization. - **aad**: Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") Additional Authenticated Data — the ASCII bytes of the base64url-encoded protected header (per RFC 7516 §5.1, step 14). ## JweToken Methods The following are methods for JweToken. - **[getAad()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getAad)** Returns the Additional Authenticated Data (AAD) associated with the JWE token. Per RFC 7516 §5.1 step 14, the AAD is the US-ASCII byte encoding of the base64url-encoded JWE protected header. This value is bound to the ciphertext by the AEAD algorithm and must match at decryption time. - **[getAlgorithm()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getAlgorithm)** Returns the key management algorithm from the JWE protected header. This is the alg value that governs how the content encryption key (CEK) is protected. - **[getCiphertext()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getCiphertext)** Returns the encrypted content of the JWE — the fourth component of the compact serialization (before the authentication tag). - **[getEncryptedKey()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getEncryptedKey)** Returns the wrapped content encryption key (CEK), the second component of the JWE compact serialization. This value is decrypted using the recipient's key management key (per getAlgorithm()) to recover the CEK, which is then used to decrypt getCiphertext(). - **[getEncryptionAlgorithm()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getEncryptionAlgorithm)** Returns the content encryption algorithm from the JWE protected header. This is the enc value that governs how the payload is encrypted. - **[getEphemeralPublicKey()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getEphemeralPublicKey)** Returns the ephemeral public key from the JWE protected header (the epk JWK). The key is returned in X.509 SubjectPublicKeyInfo DER encoding, suitable for passing to standard key deserialization utilities. - **[getIv()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getIv)** Returns the initialization vector used for content decryption — the third component of the JWE compact serialization. - **[getTag()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_getTag)** Returns the authentication tag — the fifth and final component of the JWE compact serialization. The tag is used by the AEAD algorithm to detect tampering with the ciphertext or AAD. - **[toString()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_JweToken.htm#apex_System_JweToken_toString)** Returns a string representation of the token suitable for debugging and logging. The output contains only metadata (algorithm identifiers and byte lengths) and never exposes the ephemeral public key, wrapped CEK, ciphertext, or authentication tag. ### getAad() Returns the Additional Authenticated Data (AAD) associated with the JWE token. Per RFC 7516 §5.1 step 14, the AAD is the US-ASCII byte encoding of the base64url-encoded JWE protected header. This value is bound to the ciphertext by the AEAD algorithm and must match at decryption time. #### Signature public Blob getAad() #### Return Value Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") The Additional Authenticated Data bytes. Never null for tokens produced by Crypto.parseJwe. ### getAlgorithm() Returns the key management algorithm from the JWE protected header. This is the alg value that governs how the content encryption key (CEK) is protected. #### Signature public String getAlgorithm() #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The key management algorithm identifier. The supported values are ECDH-ES+A128KW, ECDH-ES+A192KW, and ECDH-ES+A256KW. #### Example JweToken token = Crypto.parseJwe(compactJwe); if (token.getAlgorithm() == 'ECDH-ES+A128KW') { // ECDH-ES key agreement with A128KW key wrap } ### getCiphertext() Returns the encrypted content of the JWE — the fourth component of the compact serialization (before the authentication tag). #### Signature public Blob getCiphertext() #### Return Value Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") The ciphertext bytes. Length depends on the content encryption algorithm and the size of the original plaintext. The maximum supported ciphertext size is approximately 1 MB plus padding and tag overhead. ### getEncryptedKey() Returns the wrapped content encryption key (CEK), the second component of the JWE compact serialization. This value is decrypted using the recipient's key management key (per getAlgorithm()) to recover the CEK, which is then used to decrypt getCiphertext(). #### Signature public Blob getEncryptedKey() #### Return Value Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") The encrypted content encryption key bytes. Always present for the supported ECDH-ES+A\*KW algorithms because these wrap the CEK with AES Key Wrap. ### getEncryptionAlgorithm() Returns the content encryption algorithm from the JWE protected header. This is the enc value that governs how the payload is encrypted. #### Signature public String getEncryptionAlgorithm() #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") The content encryption algorithm identifier. Supported values include: | value | description | | --- | --- | | A128GCM | AES-128 in Galois/Counter Mode | | A192GCM | AES-192 in Galois/Counter Mode | | A256GCM | AES-256 in Galois/Counter Mode | | A128CBC-HS256 | AES-128 in CBC mode with HMAC-SHA-256 | | A192CBC-HS384 | AES-192 in CBC mode with HMAC-SHA-384 | | A256CBC-HS512 | AES-256 in CBC mode with HMAC-SHA-512 | An unsupported value causes Crypto.parseJwe to throw a SecurityException. Therefore, this method never returns an unsupported value for a token that has been parsed successfully. ### getEphemeralPublicKey() Returns the ephemeral public key from the JWE protected header (the epk JWK). The key is returned in X.509 SubjectPublicKeyInfo DER encoding, suitable for passing to standard key deserialization utilities. #### Signature public Blob getEphemeralPublicKey() #### Return Value Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") The DER-encoded ephemeral public key bytes. Usage For ECDH-ES key agreement algorithms, the ephemeral public key contributes half of the shared secret. Applications that need to perform key agreement outside of Crypto.decrypt(...) can use this method to obtain the peer's ephemeral key material. ### getIv() Returns the initialization vector used for content decryption — the third component of the JWE compact serialization. #### Signature public Blob getIv() #### Return Value Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") The initialization vector bytes. Length depends on the content encryption algorithm: - 12 bytes for A128GCM / A192GCM / A256GCM - 16 bytes for A128CBC-HS256 / A192CBC-HS384 / A256CBC-HS512 ### getTag() Returns the authentication tag — the fifth and final component of the JWE compact serialization. The tag is used by the AEAD algorithm to detect tampering with the ciphertext or AAD. #### Signature public Blob getTag() #### Return Value Type: [Blob](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_blob.htm#apex_methods_system_blob "Contains methods for the Blob primitive data type.") The authentication tag bytes. Length depends on the content encryption algorithm: - 16 bytes for GCM variants (A128GCM, A192GCM, and A256GCM) - 16, 24, or 32 bytes for CBC-HS variants (A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 respectively) ### toString() Returns a string representation of the token suitable for debugging and logging. The output contains only metadata (algorithm identifiers and byte lengths) and never exposes the ephemeral public key, wrapped CEK, ciphertext, or authentication tag. #### Signature public String toString() #### Return Value Type: [String](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_methods_system_string.htm#apex_methods_system_string "Contains methods for the String primitive data type.") A formatted string of the form: System.JweToken\[alg=, enc=, epkLen=, encKeyLen=, ivLen=, ciphertextLen=, tagLen=, aadLen=\] #### Example JweToken token = Crypto.parseJwe(compactJwe); System.debug(token); // System.JweToken\[alg=ECDH-ES+A128KW, enc=A128GCM, epkLen=91, // encKeyLen=24, ivLen=12, ciphertextLen=48, tagLen=16, aadLen=112\]