JWT - Generator node

The JWT - Generator node creates a JSON Web Token (JWT) using the configured claims, signature, and optional encryption settings.

This node is available in: Authentication, Admin, Self Service, API, Consent, Library, Custom, User Defined

Node configurations

JWT TTL: Define the token lifetime (in seconds). After this time, the token expires.
JWT Claims: Define the claims included in the token payload.
- Default Claims flags: Each claim can optionally be excluded.
  - iat: Issued at
  - iss: Issuer
  - sub: Subject
  - exp: Expiration
- Custom Claims:
  - Key: Claim name
  - Value: Static value or flow variable
  - Type: Data type (String, Number, Boolean, Array, Object)
For array or object type claims, the value is populated either through the UI's repeatable key-value entry, or by referencing a {{variable}} that already resolves to that array or object at runtime.
Choose Signature type: Enables signing of the JWT to ensure integrity and authenticity.
- JWK Configuration:
  - Symmetric Key (Password): Uses a shared secret (HS256, HS384 or HS512)
    - KID: Unique identifier of the key used to sign the token. It is included in the JWT header.
    - OCT Algorithm: Define the signing algorithm (e.g., HS256, HS384, HS512).
    - Password: The secret (for symmetric) or key material (for asymmetric signing).
    - JWK: JSON representation of the key. Can be auto-generated or manually edited.
  - Asymmetric Key: Uses public/private key pairs (RSA or EC).
    - Asymmetric Key Type: Choose between RSA and EC algorithm.
    - KID: Unique identifier of the key used to sign the token. It is included in the JWT header.
    - Key Size: Define the size of the RSA key in bits (e.g., 2048, 4096).
    - RSA Algorithm: Specify the RSA-based signing algorithm to use (e.g., RS256, RS384, RS512).
    - EC Algorithm: Specify the EC-based signing algorithm to use (e.g., ES256, ES384, ES512).
    - Curve: Define the elliptic curve used for EC-based cryptographic operations.
    - Private Key: The private key used to sign the JWT. This key must be kept secure and never exposed publicly.
    - Public Key: The public key used to verify the JWT signature. It can be safely shared with external systems that need to validate the token.
    - Private JWK: The Private JWK represents the private key in JSON Web Key (JWK) format. It is used for signing (or decrypting) operations. The field can be automatically generated or manually edited.
    - Public JWK: The Public JWK represents the public key in JSON Web Key (JWK) format. It is used for verification (or encryption) operations. The field can be automatically generated or manually edited.
Choose Encryption type: Enables encryption of the JWT (JWE) to add an extra layer of security.
- JWK Configuration:
  - Symmetric Key (Password): Uses a shared secret (A128KW, A256KW etc.).
    - KID: Unique identifier of the key used to sign the token.
    - OCT Algorithm: Defines the signing algorithm (e.g., A128KW, A256KW).
    - Password: The secret (for symmetric) or key material (for asymmetric signing).
    - JWK: JSON representation of the key. Can be auto-generated or manually edited.
  - Asymmetric Key: Uses public key (RSA or EC).
    - Asymmetric Key Type: Choose between RSA and EC algorithm.
    - KID: Unique identifier of the key.
    - Key Size: Define the size of the RSA key in bits (e.g., 2048, 4096).
    - RSA Algorithm: Specify the RSA-based encryption algorithm to use (e.g., RSA-OAEP, RSA-OAEP-256).
    - EC Algorithm: Specify the EC-based encryption algorithm to use (e.g., ECDH-ES, ECDH-ES+A128KW).
    - Curve: Define the elliptic curve used for EC-based cryptographic operations.
    - Public Key: The public key used to verify the JWT signature.
    - Public JWK: The public key in JSON Web Key (JWK) format.

Save in the flow store

Attributes generated or retrieved from the node can be saved into a variable. They can then be reused by other nodes in the flow by referencing them as {{variable.attribute}}.

To do this you choose attributes (displayed in a multi-select dropdown) that need to be stored and then a variable name that can be defined by the user.

There is also a flag to make the variable available to the frontend.

Default output node

True
Failure

JSON metadata

{
    "name": "generate_jwt_v3",
    "active": true,
    "bundleName": "default-nodes",
    "bundleVersion": "1.0",
    "category": "encryption_signing",
    "deprecated": false,
    "displayName": [{
            "lang": "en",
            "value": "JWT - Generator"
        }, {
            "lang": "it",
            "value": "JWT - Generator"
        }
    ],
    "nodeName": "GenerateJwtV3",
    "index": 3,
    "inputs": [{
            "name": "Input"
        }
    ],
    "outputs": [{
            "name": "Success",
            "level": "success"
        }, {
            "name": "Failure",
            "level": "error"
        }
    ]
}

Suggest A Change