Client Assertion JWT
Last updated
Last updated
This authentication method leverages PKI (Public Key Infrastructure) and eliminates the need to store or transfer shared secrets. For more details, refer to the .
How it works
The client must generate an assertion JWT containing the specified header and claims, signed with one of the private keys corresponding to the public keys included in the JWKS provided during onboarding.
Client Assertion JWT Structure
JWT Header Example
JWT Header Fields
alg
The algorithm used for signing the JWT. Supported values are ES256, ES256K, ES384, and ES512.
kid
The Key ID associated with the signing key, matching the JWK provided during onboarding.
typ
The type of the token, typically set to "JWT".
JWT Claims
sub
The client ID of the registered client.
aud
The recipient for whom this JWT is intended. This must match the issuer field in the response of the OpenID Discovery endpoint.
iss
The client ID of the registered client.
iat
exp
The expiration time on or after which the JWT must not be accepted by Corppass for processing.
jti
The unique identifier for the JWT, used to prevent token reuse.
The time at which the JWT was issued. Refer to the for details.
To avoid disruptions, please plan to update your applications accordingly to avoid any disruptions. We strongly recommend reviewing the updated API documentation and transitioning to the new requirements as soon as possible.
Corppass will reject tokens with an exp longer than 10 minutes from the iat . Refer to the for more details.
This claim is optional in the existing API version; refer to for details. However, it is strongly recommended for enhanced security, as outlined in . This claim will be mandatory in the next major API version. Implementations must ensure the jti is unique for each JWT.