Tools

SSO JWT builder

Fill in the claims the inbound login expects, sign with a shared secret or a test RSA key, and copy a ready login call. Or paste any token to see its header, payload, expiry and whether the signature verifies.

Runs in your browser (WebCrypto) - keys and tokens never leave this tab

Signing

The same value saved in the CRM under Broker login (SSO). Use at least 32 random characters in production.
Key id, needed when the brand uses a JWKS URL.
exp = iat + lifetime; the brand's max age is 300 s by default.

Claims

Exactly the issuer saved in the CRM.
The audience saved in the CRM.
Your client id = external_id (1-191 chars: letters, digits, . _ @ : + -).
Unique per token - every token works exactly once.

Optional name / e-mail claims are only used when the client is created on first sign-in.

Login call

Signing…
  • sub is a valid external_id
  • exp - iat = 0 s
  • Expired - press Now to refresh iat / exp
  • jti missing (token_jti)
Token
—
Header · payload
{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "iss": "https://id.your-platform.com",
  "aud": "octolit-brand-13",
  "sub": "cust_10042",
  "iat": 0,
  "exp": 0,
  "jti": "",
  "email": "anna@example.com",
  "given_name": "Anna",
  "family_name": "Lindqvist"
}
POST /api/sso/brands/{brand_id}/login
curl -i -X POST "https://api.your-brand.com/api/sso/brands/13/login" \
  -H "Content-Type: application/json" \
  -d '{"token":"<jwt>","target":"trader"}'

# or send the browser there:
# https://api.your-brand.com/api/sso/brands/13/login?token=<jwt>&target=trader

No API key: the token is the credential. Success answers 302 to the brand app; add &format=json on the GET form to see the result as JSON.

#How it works

  • The header is { "alg": "HS256" | "RS256", "typ": "JWT", "kid"?: "…" }; the payload carries iss, aud, sub, iat, exp, jti (all required) plus the optional nbf, email, name, given_name, family_name.
  • HS256 signs base64url(header).base64url(payload) with HMAC-SHA256 and the shared secret; RS256 uses RSASSA-PKCS1-v1_5 with SHA-256 and your private key (PKCS#8). The platform verifies with the secret or public key saved for the brand.
  • exp - iat may not exceed the brand's token max age (300 s by default), 60 s clock skew is allowed, and every jti works once.
  • Send the browser to GET /api/sso/brands/{brand_id}/login?token=… or post { "token", "target" } to the same path. No API key is needed.
Test keys only
The generated key pair is for trying the flow. Keep production private keys on your server and publish the public key (or a JWKS URL) in the CRM.

Claims, settings and every error code: Single sign-on reference.