---
sourceDocument: Australia Financial Services Operations
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/financial-services-operations

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Financial Services Operations

ft:clusterId :

    - finso

bundleId :

    - finso

workflow :

    - Customer and Industry


---

# JWT Authentication

# JWT Authentication {#ariaid-title1}

Release version: Australia  
Updated April 6, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The Verifi Issuer API uses JSON Web Tokens (JWT) for authentication. A fresh JWT must be generated for every API call. This section explains how to store credentials securely and how the ServiceNow® script generates and attaches the JWT.
{#jwt-authentication__table_wxg_jqm_53c__entry__3}

| Header | Value Format | Description |
|-|-|-|
| Authorization | Bearer \<encoded JWT\> | Base64url-encoded JWT signed with HMAC SHA-256 using the shared secret. |
| x-verifi-issuer | \<Issuer ID\> | Your numeric Issuer ID assigned by Verifi. This value must match the iss claim in the JWT payload. |
[Table 1. API authentication header information]

{#jwt-authentication__table_wxg_jqm_53c} {#jwt-authentication__entry__11}

| Type | Details |
|-|-|
| Header | { "alg": "HS256", "typ": "JWT" } |
| Payload | { "iss": "<issuer_id>", "jti": "<UUID --- unique per call>", "iat": <epoch_now>, "exp": <epoch_now + 299> } |
[Table 2. JWT Structure]

{#jwt-authentication__entry__18}

| Claim | Required | Description / Validation Rule |
|-|-|-|
| iss | Yes | Set to your numeric Issuer ID as a string. Must match the x-verifi-issuer header exactly. |
| jti | Yes | A UUID generated fresh for every request. Verifi rejects duplicate jti values from the same issuer --- use crypto.randomUUID() or equivalent. |
| iat | Yes | Unix epoch timestamp (UTC) at the moment the JWT is constructed. Must be a number, not a string. Verifi rejects values more than 300 seconds in the past or any value in the future. |
| exp | Yes | Unix epoch timestamp (UTC) for token expiration. Must be a number. Must not exceed iat + 300 seconds. Recommended: set to iat + 299. |
[ ]

Note:  
Both iat and exp must be numeric (integer) Unix epoch values and not ISO 8601 date strings. Passing a string will cause Verifi to return a 401 Unauthorized error.