---
schema_version: "1"
id: 4dc5468cba7fbcaaf37d4b26f199f74350e5f63a7d386e928f6ad23910d27d2b
title: Credential Injection JWT Generation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/policies-outbound-jwt-generation.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/policies-outbound-jwt-generation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: e0760962f938f3a5395cc4e75f45fa06d7c6105c9781673df4717aefeb080ed5
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
keywords: jwt, token, authentication, api gateway, flex gateway, gateway, policy
---

# Credential Injection JWT Generation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Credential Injection JWT Generation</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Generates and injects a JWT token into outgoing requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.12.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy. Error codes are returned from the upstream service.</p></td></tr></tbody></table>

## Summary

The Credential Injection JWT Generation policy generates and injects a JWT token into outgoing
requests. It signs the token with the configured key and algorithm and supports standard time-based
claims, such as `exp`, `iat`, and `nbf`, in addition to custom claims and JWT headers. Each claim
and header name and value can be a string or a DataWeave expression. Expressions can reference
request attributes or authentication data.

## Configuring Policy Parameters

### Flex Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: jwt-generation-flex config: signingMethod: <string> // REQUIRED, default: RS256
privateKey: <string> // REQUIRED iat: <boolean> // REQUIRED, default: true exp: <number> //
REQUIRED, default: 0 nbf: <number> // REQUIRED, default: 0 customClaims: // REQUIRED (can be empty
array) - name: <string> value: <string> customHeaders: // REQUIRED (can be empty array) - name:
<string> value: <string>

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>signingMethod</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>RS256</code></p></div></div></td><td><div><div><p>The algorithm that signs the JWT. Supported values: <code>RS256</code>, <code>RS384</code>, <code>RS512</code>, <code>HS256</code>, <code>HS384</code>, <code>HS512</code>, <code>ES256</code>, and <code>ES384</code>.</p></div></div></td></tr><tr><td><div><div><p><code>privateKey</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The key that signs the JWT. Use PEM-formatted pkcs8 for RSA and ES. Use plain text for HS.</p></div></div></td></tr><tr><td><div><div><p><code>iat</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>A Boolean value specifying whether to include the issued-at (iat) claim in the JWT.</p></div></div></td></tr><tr><td><div><div><p><code>exp</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>0</code></p></div></div></td><td><div><div><p>The number of seconds from the issue time until expiration. To omit the <code>exp</code> claim, enter <code>0</code>.</p></div></div></td></tr><tr><td><div><div><p><code>nbf</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>0</code></p></div></div></td><td><div><div><p>The number of seconds from the issue time until the token becomes valid. To omit the <code>nbf</code> claim, enter <code>0</code>.</p></div></div></td></tr><tr><td><div><div><p><code>customClaims</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The claims to include in the JWT. Each entry has a <code>name</code> and a <code>value</code>. Each can be a string or a DataWeave expression. The array can be empty.</p></div></div></td></tr><tr><td><div><div><p><code>customHeaders</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The JWT header parameters to include. Each entry has a <code>name</code> and a <code>value</code>. Each can be a string or a DataWeave expression. The array can be empty.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Examples

- HMAC-signed JWT with custom claim:

  \- policyRef: name: jwt-generation-flex config: signingMethod: HS256 privateKey: my-secret-key
  iat: true exp: 3600 nbf: 0 customClaims: - name: "sub" value:
  "#\[authentication.properties.clientId default 'anonymous'\]" customHeaders: \[\]

- RSA-signed JWT with custom claims and headers:

  \- policyRef: name: jwt-generation-flex config: signingMethod: RS256 privateKey: | -----BEGIN
  PRIVATE KEY----- <your-private-key> -----END PRIVATE KEY----- iat: true exp: 7200 nbf: 0
  customClaims: - name: "aud" value: "'https://upstream.example.com'" - name: "client\_id" value:
  "#\[authentication.properties.clientId\]" customHeaders: - name: "kid" value: "'key-1'"

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Required?</th></tr></thead><tbody><tr><td><p>Signing Method</p></td><td><p>The algorithm that signs the JWT. Valid values are RS256, RS384, RS512, HS256, HS384, HS512, ES256, and ES384.</p></td><td><p>Required</p></td></tr><tr><td><p>Private Key</p></td><td><p>The key that signs the JWT. Use PEM with pkcs8 for RSA and ES. Use plain text for HS.</p></td><td><p>Required</p></td></tr><tr><td><p>Issued At (iat)</p></td><td><p>A Boolean value specifying whether to include the issued-at (<code>iat</code>) claim in the JWT.</p></td><td><p>Required</p></td></tr><tr><td><p>Expiration (exp)</p></td><td><p>The number of seconds from the issue time until expiration. To omit the <code>exp</code> claim, enter <code>0</code>.</p></td><td><p>Required</p></td></tr><tr><td><p>Not Before (nbf)</p></td><td><p>The number of seconds from the issue time until the token becomes valid. To omit the <code>nbf</code> claim, enter <code>0</code>.</p></td><td><p>Required</p></td></tr><tr><td><p>Custom Claims</p></td><td><p>The claims to include in the JWT. Each entry has a <code>name</code> and a <code>value</code>. Each can be a string or a DataWeave expression. The array can be empty.</p></td><td><p>Required</p></td></tr><tr><td><p>Custom Headers</p></td><td><p>The JWT header parameters to include. Each entry has a <code>name</code> and a <code>value</code>. Each can be a string or a DataWeave expression. The array can be empty.</p></td><td><p>Required</p></td></tr></tbody></table>