Authentication Methods in ZITADEL
Client Secret Basic​
When using client_secret_basic
on token or introspection endpoints, provide anAuthorization
header with a Basic auth value in the following form:
Authorization: "Basic " + base64( formUrlEncode(client_id) + ":" + formUrlEncode(client_secret) )
Given the client_id 78366401571920522@amce
and client_secret veryweaksecret!
, this would result in the following Authorization
header:
Basic NzgzNjY0MDE1NzE5MjA1MjIlNDBhbWNlOnZlcnl3ZWFrc2VjcmV0JTIx
JWT with Private Key​
When using private_key_jwt
(urn:ietf:params:oauth:client-assertion-type:jwt-bearer
) for token or introspection endpoints, provide a JWT as assertion generated with the following structure and signed with a downloaded key:
Key JSON
Key | Example | Description |
---|---|---|
type | "application" | The type of account, right now only application is valid |
keyId | "81693565968962154" | This is unique ID of the key |
key | "-----BEGIN RSA PRIVATE KEY-----...-----END RSA PRIVATE KEY-----" | The private key generated by ZITADEL, this can not be regenerated! |
clientId | 78366401571920522@acme | The client_id of the application, this is the same as the subject from tokens |
appId | 78366403256846242 | The id of the application (just for completeness, not used for JWT) |
{
"type": "application",
"keyId": "81693565968962154",
"key": "-----BEGIN RSA PRIVATE KEY-----...-----END RSA PRIVATE KEY-----",
"clientId": "78366401571920522@acme",
"appId": "78366403256846242"
}
JWT
Claim | Example | Description |
---|---|---|
aud | "https://$CUSTOM-DOMAIN" | String or Array of intended audiences MUST include ZITADEL's issuing domain |
exp | 1605183582 | Unix timestamp of the expiry |
iat | 1605179982 | Unix timestamp of the creation singing time of the JWT, MUST NOT be older than 1h |
iss | "78366401571920522@acme" | String which represents the requesting party (owner of the key), normally the clientID from the json key file |
sub | "78366401571920522@acme" | The subject ID of the application, normally the clientID from the json key file |
{
"iss": "78366401571920522@acme",
"sub": "78366401571920522@acme",
"aud": "https://$CUSTOM-DOMAIN",
"exp": 1605183582,
"iat": 1605179982
}
To identify your key, it is necessary that you provide a JWT with a
kid
header claim representing your keyId from the Key JSON:{
"alg": "RS256",
"kid": "81693565968962154"
}