Configure JWT-secured Authorization Requests (JAR)

Before configuring your application for JAR, generate an RSA key pair and upload the public key to Auth0 in PEM format for your application. You can do it via the Management API as follows:

curl --location 'https://{yourTenant}/api/v2/clients/{yourClientId}/credentials' \
--header 'Authorization: Bearer $management_access_token' \
--header 'Content-Type: application/json' \
--data '{
  "name": "My credentials for JAR",
  "credential_type": "public_key",
  "pem": "[YOUR PEM FILE CONTENT]",
  "alg": "RS256"
}'

A credential ID will be returned upon creation with the cred_ prefix. Save your credential ID and kid to configure JAR. The kid will be used in your JWT header.

You can configure JAR for your application using the signed_request_object client configuration property. This object property contains the following fields:

• required: forces all authorization requests to the /authorize and /oauth/par to use JAR. To learn more, read Authorization Code Flow with JWT-Secured Authorization Requests and Authorization Code Flow with PAR and JAR.

• credentials: an array of credential IDs used to verify signatures.

You can configure JAR for a new application or for an existing application via the Management API.

When you create a new application, configure JAR by sending a POST request with the signed_request_object. In that POST request, you can also register the corresponding client credential (i.e. the key PEM):

POST https://{yourTenant}.auth0.com/api/v2/clients
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
  "name": "My App using JAR",
  "signed_request_object": {
      "required": true,
"credentials": [{
        "name": "My credential for JAR",
        "credential_type": "public_key",
        "pem": "[YOUR PEM FILE CONTENT]",
        "alg": "RS256"
}]
  },
  "jwt_configuration": {
    "alg": "RS256"
  }
}

When updating an existing application, you need to explicitly create a client credential first. The following POST request uses your PEM file content to create your client credentials for JAR:

POST https://{yourTenant}.auth0.com/api/v2/clients/{yourClientId}/credentials
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
  "name": "My credentials for JAR",
  "credential_type": "public_key",
  "pem": "[YOUR PEM FILE CONTENT]",
  "alg": "RS256"
}

Then, assign the client credential to the signed_request_object client configuration. The following PATCH request associates your client credentials with the signed_request_object:

PATCH https://{yourTenant}.auth0.com/api/v2/clients/{yourClientId}
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
  "signed_request_object": {
    "credentials": [{"id": "[YOUR CREDENTIAL ID]"}]
  }
}

• Authorization Code Flow with JWT-Secured Authorization Requests (JAR)
• Authorization Code Flow with PAR and JAR