Configure JWT-secured Authorization Requests (JAR)
To use Highly Regulated Identity features, you must have an Enterprise Plan with the Highly Regulated Identity add-on. Refer to Auth0 Pricing for details.
JWT-Secured Authorization Requests (JAR) allow OAuth2 authorization request parameters to be packaged into a single JWT request parameter which is then signed for integrity protection.
Prerequisites
Before configuring your application for using JAR, you must generate an RSA key pair.
You should generate a separate key pair for each type of credential usage. For example, do not reuse the same key pairs for both JAR and Private Key JWT Authentication.
Configure JAR for an application
You can configure JAR for an application with the Auth0 Dashboard and the Management API.
Use the Auth0 Dashboard to configure your application to use JAR with previously generated RSA keys.
Navigate to Auth0 Dashboard > Applications.
Select the application you want to use with JAR.
Select the Application Settings tab.
In the Authorization Requests section, enable Require JWT-Secured Authorization Requests.
If no credential is assigned and there are credentials available, you will be prompted to assign an existing credential.
You will also have the option to assign a new credential.
Add and assign a new credential by uploading a previously generated RSA key pair. When prompted, enter the following:
Name: a name to identify the credential
Public Key: public key of the X.509 certificate in PEM format
Algorithm: select the JAR signature algorithm
Expiration Date: set the expiration date of the credential
Use the Management API to configure JAR for your application using the signed_request_object client configuration property. This object property contains the following fields:
required: forces all authorization requests to the/authorizeand/oauth/parto use JAR. To learn more, read Authorization Code Flow with JWT-Secured Authorization Requests and Authorization Code Flow with PAR and JAR.credentials: an array of credential IDs used to verify signatures.
The credentials parameter behaves similarly to the Private Key JWT parameter client_authentication_methods.private_key_jwt.credentials which supports credential creation when you create a new application. To learn more, read Configure Private Key JWT.
You can configure JAR for a new application or for an existing application via the Management API.
Configure JAR for a new application
When you create a new application, configure JAR by sending a POST request with the signed_request_object. In that POST request, you can also register the corresponding client credential (i.e. the key PEM):
POST https://{yourTenant}.auth0.com/api/v2/clients
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
"name": "My App using JAR",
"signed_request_object": {
"required": true,
"credentials": [{
"name": "My credential for JAR",
"credential_type": "public_key",
"pem": "[YOUR PEM FILE CONTENT]",
"alg": "RS256"
}]
},
"jwt_configuration": {
"alg": "RS256"
}
}Was this helpful?
Configure JAR for an existing application
When updating an existing application, you need to explicitly create a client credential first. The following POST request uses your PEM file content to create your client credentials for JAR:
POST https://{yourTenant}.auth0.com/api/v2/clients/{yourClientId}/credentials
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
"name": "My credentials for JAR",
"credential_type": "public_key",
"pem": "[YOUR PEM FILE CONTENT]",
"alg": "RS256"
}Was this helpful?
Make sure newlines are properly JSON-encoded with no additional formatting.
Then, assign the client credential to the signed_request_object client configuration. The following PATCH request associates your client credentials with the signed_request_object:
PATCH https://{yourTenant}.auth0.com/api/v2/clients/{yourClientId}
Authorization: Bearer [YOUR ACCESS TOKEN]
Content-Type: application/json
{
"signed_request_object": {
"credentials": [{"id": "[YOUR CREDENTIAL ID]"}]
}
}Was this helpful?