---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Generate a JSON Web Token (JWT)

# Generate a JSON Web Token (JWT) {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Create a JSON Web Token (JWT) for representing claims securely between two parties on
the ServiceNow AI Platform.  
The GlideJWT API is a scoped, scriptable API which generates a JWT. There are three arguments necessary before generating the JWT:

* Sys_id of [JWT
  Provider](https://www.servicenow.com/docs/9i5GT9mtpKXGYWHsT60jtw#associate-jwt-provider-key "Add a JSON Web Token (JWT) provider to your ServiceNow instance.")
* JSON serialized header
* JSON serialized payload
{#Scoped-API-generate-JWT__ul_ynb_t1w_zhb}There are two JWT API scripts, JWTTokenInternal and JWTTokenRestricted, that you can use when configuring a JWT Provider. The JWTTokenRestricted script enables administrators to configure who can generate a JWT. The JWTTokenInternal script is read-only and enables only logged in users to generate a JWT.  
To generate a JWT:

* [Create a JWT Key with a shared key
  (HMAC) or a signing keystore (RSA)](https://www.servicenow.com/docs/9i5GT9mtpKXGYWHsT60jtw#configure-JWT-signing-key "Create a JSON Web Token (JWT) signing key to assign to your Java KeyStore (JKS) certificate,")
* [Associate a JWT provider with the
  signing configuration referring a JWT key](https://www.servicenow.com/docs/9i5GT9mtpKXGYWHsT60jtw#associate-jwt-provider-key "Add a JSON Web Token (JWT) provider to your ServiceNow instance.")
{#Scoped-API-generate-JWT__ul_nsn_kcj_r3b}You can use the API to create your token.

You can use standard and custom
claims
when configuring a JWT provider. You can
pass
dynamic header and payload claims as part of the
generateJWT API signature.  
Sample script to test API:

    var jwtAPI = new sn_auth.GlideJWTAPI();
    var headerJSON = {  "kid": "a1234"  };
    var header = JSON.stringify(headerJSON);

    var payloadJSON = { "jti": "testjti", "iss": "testiss", "sub": "testsub" };
    var payload = JSON.stringify(payloadJSON);

    var jwtProviderSysId = "7a40dde2d5303300964fb7c8f3c14ab5";
    var jwt = jwtAPI.generateJWT(jwtProviderSysId, header, payload);

    gs.info("JWT:" + jwt);