Under maintenance

Heretto Help

Create a JWT

Important:

For production applications, sign your JSON Web Token (JWT) server-side using appropriate libraries. Never expose your secret keys in client-side code or third-party web tools.

Create a JWT by specifying its header and payload, and signing it with your JWT HS256 key generated in Heretto CCMS.

Create a JWT HS256 key. See Create an API Key.

This procedure provides the details you need to configure the header, payload, and signature of your JWT. It doesn't provide step by step instructions of how to do it in a specific tool or library.

  1. In the header, set the algorithm to HS256 and token type to JWT.
    {
      "alg": "HS256",
      "typ": "JWT"
      }
  2. Configure the payload based on your access requirements:
    • For basic access that grants access to all content included in the deployment, use an empty payload:

      {}
      Note:

      When your JWT doesn't have an audience value embedded, requests are mapped to the default audience.

    • For audience-based content filtering, add:

      {
        "https://jorsek.com/content/audiences": [
          "your_audience_name"
        ]
      }

      Where your_audience_name is the value attribute in the data element referencing a DITAVAL file in the main sitemap associated with your deployment. For example, if your sitemap contains:

      <data href="../filters/private.ditaval" name="content-api-audience" value="private"/>

      Use:

      {
        "https://jorsek.com/content/audiences": [
          "private"
        ]
      }
      Note: If the value attribute is not specified in your sitemap data element, use an empty payload {}.
  3. Sign the token with the JWT HS256 key created in Heretto CCMS.
  4. Generate the JWT.
    The token consists of three base64-encoded sections separated by dots: header.payload.signature
    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWRpZW5jZSI6InlvdXJfYXVkaWVuY2VfbmFtZSJ9.b3DJPBQNkD-qY_0tbPIrqI-Dz6nbFVIBnIzWto_Nal4
Make Authenticated API Calls