---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Generate a JSON Web Token (JWT)

# Generate a JSON Web Token (JWT) {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create a JSON Web Token (JWT) for representing claims securely between two parties on
the ServiceNow AI Platform.  
The [GlideJWT API](https://www.servicenow.com/docs/access?context=GlideJWTScopedAPI&version=brazil&pubname=brazil-api-reference&ft:locale=en-US) is a scoped, scriptable API which generates a JWT. There are three arguments necessary before generating the JWT:

* Sys_id of [JWT
  Provider](https://www.servicenow.com/docs/tvE88Yvk9uZMK2wKkOHMaQ#associate-jwt-provider-key "Add a JSON Web Token (JWT) provider to your ServiceNow instance.")
* JSON serialized header
* JSON serialized payload
{#Scoped-API-generate-JWT__ul_ynb_t1w_zhb}There are two JWT API scripts, JWTTokenInternal and JWTTokenRestricted, that you can use when configuring a JWT Provider. The JWTTokenRestricted script enables administrators to configure who can generate a JWT. The JWTTokenInternal script is read-only and enables only logged in users to generate a JWT.  
To generate a JWT:

* [Create a JWT Key with a shared key
  (HMAC) or a signing keystore (RSA)](https://www.servicenow.com/docs/tvE88Yvk9uZMK2wKkOHMaQ#configure-JWT-signing-key "Create a JSON Web Token (JWT) signing key. The key can be a certificate uploaded to the instance, or a private key managed by the Key Management Framework (KMF).")
* [Associate a JWT provider with the
  signing configuration referring a JWT key](https://www.servicenow.com/docs/tvE88Yvk9uZMK2wKkOHMaQ#associate-jwt-provider-key "Add a JSON Web Token (JWT) provider to your ServiceNow instance.")
{#Scoped-API-generate-JWT__ul_nsn_kcj_r3b}You can use the API to create your token.

You can use standard and custom
claims
when configuring a JWT provider. You can
pass
dynamic header and payload claims as part of the
generateJWT API signature.  
Sample script to test API:

    var jwtAPI = new sn_auth.GlideJWTAPI();
    var headerJSON = {  "kid": "a1234"  };
    var header = JSON.stringify(headerJSON);

    var payloadJSON = { "jti": "testjti", "iss": "testiss", "sub": "testsub" };
    var payload = JSON.stringify(payloadJSON);

    var jwtProviderSysId = "7a40dde2d5303300964fb7c8f3c14ab5";
    var jwt = jwtAPI.generateJWT(jwtProviderSysId, header, payload);

    gs.info("JWT:" + jwt);