You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pages/guides/authentication/JWT/index.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,9 @@
2
2
3
3
<InlineAlertslots="text"/>
4
4
5
-
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration.md).
5
+
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration).
6
6
7
-
To establish a secure service-to-service Adobe I/O API session, you must create a JSON Web Token (JWT) that encapsulates the identity of your integration, and then exchange it for an access token. Every request to an Adobe service must include the access token in the `Authorization` header, along with the API Key (Client ID) that was generated when you created the [Service Account Integration](../service-account-integration.md) in the [Adobe Developer Console](https://developer.adobe.com/console/).
7
+
To establish a secure service-to-service Adobe I/O API session, you must create a JSON Web Token (JWT) that encapsulates the identity of your integration, and then exchange it for an access token. Every request to an Adobe service must include the access token in the `Authorization` header, along with the API Key (Client ID) that was generated when you created the [Service Account Integration](../service-account-integration) in the [Adobe Developer Console](https://developer.adobe.com/console/).
8
8
9
9
## Authentication Workflow
10
10
@@ -22,7 +22,7 @@ Your JWT must contain the following claims:
22
22
| iss |_Required_. The issuer, your **Organization ID** from the Adobe Developer Console integration, in the format `org_ident@AdobeOrg`. Identifies your organization that has been configured for access to the Adobe I/O API.|
23
23
| sub |_Required_. The subject, your **Technical Account ID** from the Adobe Developer Console integration, in the format: `[email protected]`.|
24
24
| aud |_Required_. The audience for the token, your **API Key** from the Adobe Developer Console integration, in the format: `https://ims-na1.adobelogin.com/c/api_key`.|
25
-
| Metascopes |_Required_. The API-access claim configured for your organization: [JWT Metascopes](scopes.md), in the format: `"https://ims-na1.adobelogin.com/s/meta_scope": true`|
25
+
| Metascopes |_Required_. The API-access claim configured for your organization: [JWT Metascopes](scopes), in the format: `"https://ims-na1.adobelogin.com/s/meta_scope": true`|
26
26
27
27
The following is a sample payload to be signed and encoded.
28
28
@@ -40,7 +40,7 @@ The following is a sample payload to be signed and encoded.
40
40
41
41
The JWT must be signed and base-64 encoded for inclusion in the access request. The JWT libraries provide functions to perform these tasks.
42
42
43
-
- The token must be signed using the private key for a digital signing certificate that is associated with your API key. You can associate more than one certificate with an API key. If you do so, you can use the private key of any associated certificate to sign your JWT. For more information about private key/public certificate, see [Create a public key certificate](./jwt-certificate.md#using-the-public-key-certificate-for-service-account-integration).
43
+
- The token must be signed using the private key for a digital signing certificate that is associated with your API key. You can associate more than one certificate with an API key. If you do so, you can use the private key of any associated certificate to sign your JWT. For more information about private key/public certificate, see [Create a public key certificate](./jwt-certificate#using-the-public-key-certificate-for-service-account-integration).
44
44
45
45
**Algorithm**: **RS256** (RSA Signature with SHA-256) is an asymmetric algorithm, and it uses a public/private key pair: the identity provider has a private (secret) key used to generate the signature, and the consumer of the JWT (i.e. Adobe Developer Console) gets a public key to validate the signature.
Copy file name to clipboardExpand all lines: src/pages/guides/authentication/JWT/jwt-certificate.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
<InlineAlertslots="text"/>
4
4
5
-
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md).
5
+
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration).
6
6
7
7
Create a private key and a public certificate. Make sure you store these securely.
Copy file name to clipboardExpand all lines: src/pages/guides/authentication/JWT/samples.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
4
4
<InlineAlertslots="text"/>
5
5
6
-
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md).
6
+
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration).
7
7
8
8
The following samples demonstrate JWT generation and exchanging it with Adobe IMS endpoint to retrieve an access token.
9
9
@@ -20,4 +20,4 @@ The following samples demonstrate JWT generation and exchanging it with Adobe IM
20
20
[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-dotnet) where you can find a complete sample C#.NET code to generate a JWT and exchanging it with Adobe IMS Endpoint to retrieve an access token.
21
21
22
22
### PHP Example
23
-
[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-php) where you can find PHP code example for JWT creation and reference method that exchanges JWT with Adobe IMS Endpoint to retrieve an access token.
23
+
[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-php) where you can find PHP code example for JWT creation and reference method that exchanges JWT with Adobe IMS Endpoint to retrieve an access token.
Copy file name to clipboardExpand all lines: src/pages/guides/authentication/JWT/scopes.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
4
4
<InlineAlertslots="text"/>
5
5
6
-
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md).
6
+
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration).
7
7
8
8
JSON Web Token (JWT) metascopes govern the access and privileges for service accounts. As an application developer, you will choose the set of scopes to access certain resources by specifying the scopes as part of the encoding claims for your JWTs.
Copy file name to clipboardExpand all lines: src/pages/guides/authentication/OAuth/samples.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,4 +2,4 @@
2
2
3
3
<InlineAlertslots="text"/>
4
4
5
-
The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation.md#standard-oauth2-libraries).
5
+
The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation#standard-oauth2-libraries).
Copy file name to clipboardExpand all lines: src/pages/guides/authentication/OAuth/scopes.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,4 +2,4 @@
2
2
3
3
<InlineAlertslots="text"/>
4
4
5
-
The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation.md#oauth-20-scopes).
5
+
The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation#oauth-20-scopes).
Copy file name to clipboardExpand all lines: src/pages/guides/authentication/ServerToServerAuthentication/faqs.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,12 +32,12 @@ A credential is used to uniquely identify your integration to Adobe. To use an A
32
32
33
33
### Will my Adobe integrations or applications stop working immediately?
34
34
35
-
No. Any integration or application using the Service Account (JWT) credential will continue to work until June 30, 2025. See [deprecation timelines](./migration.md#deperecation-timelines). See section on [migration next steps](#migration-next-steps).
35
+
No. Any integration or application using the Service Account (JWT) credential will continue to work until June 30, 2025. See [deprecation timelines](./migration#deperecation-timelines). See section on [migration next steps](#migration-next-steps).
36
36
37
37
38
38
39
39
### What is the deadline to migrate to the new credential?
40
-
You must migrate your application to use the new OAuth Server-to-Server credential before June 30, 2025, to ensure your application does not face any downtime. See [deprecation timelines](./migration.md#deperecation-timelines). See [migration guide](./migration.md).
40
+
You must migrate your application to use the new OAuth Server-to-Server credential before June 30, 2025, to ensure your application does not face any downtime. See [deprecation timelines](./migration#deperecation-timelines). See [migration guide](./migration).
41
41
42
42
43
43
@@ -48,7 +48,7 @@ After June 30, 2025, you can no longer refresh certificates for integrations usi
48
48
Furthermore, Adobe will automatically convert Service Account (JWT) to OAuth Server-to-Server credentials when certificates expire or on March 1, 2026, whichever comes first.
49
49
50
50
### We can currently create new Service Account (JWT) credentials even though they are marked as deprecated. Is it recommended?
51
-
No. Creating any new Service Account (JWT) credentials is not recommended. All Service Account (JWT) credentials, whether old or new, will stop working after June 30, 2025. We recommend you avoid migrating your application again and use the new OAuth Server-to-Server credential from the beginning. See our [implementation guide](./implementation.md).
51
+
No. Creating any new Service Account (JWT) credentials is not recommended. All Service Account (JWT) credentials, whether old or new, will stop working after June 30, 2025. We recommend you avoid migrating your application again and use the new OAuth Server-to-Server credential from the beginning. See our [implementation guide](./implementation).
52
52
53
53
54
54
@@ -58,25 +58,25 @@ No. Creating any new Service Account (JWT) credentials is not recommended. All S
58
58
59
59
60
60
### What are the benefits of using the OAuth Server-to-Server credential?
61
-
You can read more about OAuth Server-to-Server credentials in our [implementation guide](./implementation.md). You can view the comparison between the OAuth Server-to-Server credential and the Service Account (JWT) credential [here](./migration.md#why-oauth-server-to-server-credentials).
61
+
You can read more about OAuth Server-to-Server credentials in our [implementation guide](./implementation). You can view the comparison between the OAuth Server-to-Server credential and the Service Account (JWT) credential [here](./migration#why-oauth-server-to-server-credentials).
62
62
63
63
64
64
65
65
66
66
### Can I programmatically rotate certificates for Service Account (JWT) credential?
67
67
No such ability is currently available. There are no plans to add such ability either.
68
68
69
-
Instead, we recommend switching to the new credential that does not use expiring certificates and allows you to [rotate client secrets](./implementation.md#rotating-client-secrets) through the UI and API ([programmatically](./implementation.md#rotating-client-secrets-programmatically)).
69
+
Instead, we recommend switching to the new credential that does not use expiring certificates and allows you to [rotate client secrets](./implementation#rotating-client-secrets) through the UI and API ([programmatically](./implementation#rotating-client-secrets-programmatically)).
70
70
71
71
72
72
73
73
### Can I programmatically rotate client secrets for OAuth Server-to-Server credentials?
74
-
Absolutely. View our guide on rotating client secrets programmatically [here](./implementation.md#rotating-client-secrets-programmatically).
74
+
Absolutely. View our guide on rotating client secrets programmatically [here](./implementation#rotating-client-secrets-programmatically).
75
75
76
76
77
77
78
78
### What should I do if my client secrets get leaked?
79
-
We recommend immediately [rotating your application's client secret](./implementation.md#rotating-client-secrets) and contacting Adobe customer support if you wish to invalidate any existing tokens.
79
+
We recommend immediately [rotating your application's client secret](./implementation#rotating-client-secrets) and contacting Adobe customer support if you wish to invalidate any existing tokens.
80
80
81
81
82
82
@@ -91,7 +91,7 @@ There are primarily three categories of integrations and custom applications tha
91
91
92
92
These are integrations provided out-of-the-box by Adobe that require a Service Account (JWT) credential to function. Example: Integration between AEM and Adobe Target, Integration between AEM and Adobe Stock, User sync tool, etc.
93
93
94
-
For these integrations Adobe already supports the OAuth Server-to-Server credentials and allows you to migrate. Apart from our general-purpose [migration guide](./migration.md), you can also refer to the migration guide for [AEM customers](https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/jwt-credentials-deprecation-in-adobe-developer-console) and [User Sync tool customers](https://github.com/adobe-apiplatform/user-sync.py/blob/user-guide-wip/en/user-manual/connect_adobe.md).
94
+
For these integrations Adobe already supports the OAuth Server-to-Server credentials and allows you to migrate. Apart from our general-purpose [migration guide](./migration), you can also refer to the migration guide for [AEM customers](https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/jwt-credentials-deprecation-in-adobe-developer-console) and [User Sync tool customers](https://github.com/adobe-apiplatform/user-sync.py/blob/user-guide-wip/en/user-manual/connect_adobe).
95
95
96
96
2. **Integrations developed by vendors**
97
97
@@ -101,7 +101,7 @@ There are primarily three categories of integrations and custom applications tha
101
101
102
102
3. **Custom integrations or applications**
103
103
104
-
These are integrations or application custom developed by an IT/development team in your organization. You are responsible for migrating these integrations. See our general-purpose [migration guide](./migration.md).
104
+
These are integrations or application custom developed by an IT/development team in your organization. You are responsible for migrating these integrations. See our general-purpose [migration guide](./migration).
105
105
106
106
107
107
@@ -129,7 +129,7 @@ There are a few ways to see if a Project is actively being used:
129
129
130
130
1. Open an impacted Project and view the 'Last service activity' date on the overview page. You can also see this information on the list of Projects page.
131
131
2. Visit the Service Account (JWT) credential overview page and look at the last access token generated at timestamp. This will tell you when this Project was last used to generate an access token.
132
-
3. Visit the Insights tab in a Project to see recent activity (API calls, Events Delivered, etc.) involving the credentials contained in the Project. See our documentation on [Insights](../../insights.md) to know more.
132
+
3. Visit the Insights tab in a Project to see recent activity (API calls, Events Delivered, etc.) involving the credentials contained in the Project. See our documentation on [Insights](../../insights) to know more.
The following guide goes over finer implementation details for OAuth Server-to-Server credentials. At the end of the guide is a list of recommended industry-standard OAuth2 libraries. Before you proceed, we recommend you become familiar with the server to server authentication credentials in our [server to server authentication guide](./index.md)
4
+
The following guide goes over finer implementation details for OAuth Server-to-Server credentials. At the end of the guide is a list of recommended industry-standard OAuth2 libraries. Before you proceed, we recommend you become familiar with the server to server authentication credentials in our [server to server authentication guide](./)
5
5
6
6
## Table of contents
7
7
+[Setting up the OAuth Server-to-Server credential](#setting-up-the-oauth-server-to-server-credential)
@@ -13,7 +13,7 @@ The following guide goes over finer implementation details for OAuth Server-to-S
13
13
14
14
## Setting up the OAuth Server-to-Server credential
15
15
16
-
Depending on the API or an Event to your project on the Adobe Developer Console, you can select the OAuth Server-to-Server credential. The OAuth Server-to-Server credential is available for all APIs and Events supporting the [Service Account (JWT) credential *(deprecated)*](./index.md#service-account-jwt-credential-deprecated).
16
+
Depending on the API or an Event to your project on the Adobe Developer Console, you can select the OAuth Server-to-Server credential. The OAuth Server-to-Server credential is available for all APIs and Events supporting the [Service Account (JWT) credential *(deprecated)*](./#service-account-jwt-credential-deprecated).
17
17
18
18
### Credential Name
19
19
@@ -51,7 +51,7 @@ curl -X POST 'https://ims-na1.adobelogin.com/ims/token/v3' \
51
51
52
52
Your integration can generate access tokens when needed. However, it is a good practice to cache access tokens for reuse until they expire. Integrations should avoid generating a new access token when a previously generated access token has not expired and can be reused. Adobe can throttle your integration if it generates too many access tokens.
53
53
54
-
Access tokens usually expire in 24 hours. To check the expiry time of an access token, see the `expires_in` field in the API response returned by the above cURL request. Note: The `expires_in` time is in seconds. See [API reference](./ims.md#fetching-access-tokens).
54
+
Access tokens usually expire in 24 hours. To check the expiry time of an access token, see the `expires_in` field in the API response returned by the above cURL request. Note: The `expires_in` time is in seconds. See [API reference](./ims#fetching-access-tokens).
55
55
56
56
### Generating access tokens using standard OAuth2 libraries
0 commit comments