---
title: JASON Web Token
slug: ps/help/en_us/vtm/userguide/jason-web-token
docTags: 
createdAt: 2026-08-02T07:48:42.004Z
---

:::hint{type="info"}
This feature is applicable only to version 22.3 and later.
:::

JSON Web Token (JWT) is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

Once encoded in a URL-safe form the JWT can be transferred from a client to a server as part of a URL query string or in a HTTP header.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/hzGquovZHaXwtnJJZ1hLi_jwtflow.png" position="flex-start" size="80" width="823" height="368" initialPath="images/jwtflow.png" githubPath="HTML5/ps-vtm-userguide/images/jwtflow.png" showCaption="false" indent="1"}

The signing and verification of JWT tokens requires cryptographic keys, either in the form of a shared secret, the public part of an asymmetric key-pair, or the entire key-pair depending on the desired mode of operation.

The Traffic Manager uses JWT catalogue to provide a centralized store of JWT keys. The JWT catalogue contains shared secrets, public and private keys that can be used to validate or generate a JWT, with the following vTM configuration:

- **Import RSA/ECDSA Public Key** - import a PEM encoded RSA or ECDSA Public Key
- **Generate RSA/ECDSA Key Pair** - generate public, private key RSA or ECDSA key pair
- **Configure HMAC Shared Secret** - configure a HMAC shared secret in base64 encoded format

## Deployment Use Case

JWT is simply a standardized way of sending information between parties, and it is possible that a JWT token could safely send via,

- URL query parameters of a HTTP request – Not recommended. (JWTs could become too long for most browsers. Browsers have limits on the length of URLs, and it’s possible for JWT tokens to be longer than those limits.)
- Authorization header of a HTTP request – Recommended. (Authorization: Bearer \<token>)

The Traffic Manager uses the following traffic script functions to parse, validate and generate the JWT tokens.

- jwt.parseheader( Input string ) : Parse the header of a JWT token and returns a hash of "error" and "description" if parsing fails else hash of key/value pairs present in header.
- jwt.validate( Input string, key, key\_file, algorithm ) : Validates the JWT token against the provided key with expected algorithms and return the hash of "error" and "description" if validation fails or "claim" if validation is successful.
- jwt.generate( Input string, key, key\_file ) : Generate the signature or digest for the input token( encoded jose header and claims ) using provided key and return the hash of "error" and "description" if generation fails or "signature" if generation is successful.

## Configuring JWT on Virtual Traffic Manager

- [Configure Public Key](docId\:Vh5K6uxWgX2gRYSx73fQE)
- [Generate Private-Public Key Pair](docId\:Vh5K6uxWgX2gRYSx73fQE)
- [Configure HMAC Secret Key](docId\:Vh5K6uxWgX2gRYSx73fQE)

### Configure Public Key

To configure public key on vTM:

1. Navigate to **Catalogs > JWT > Import.**
2. Enter the **Name**.

:::hint{type="info"}
Name should be unique, and it should not match with other key names in JWT Public Key Catalog.
:::

3. Click **Choose Key** and select public key file.
4. Click **Import Key**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/dyUcdZEiS__NbPQAcaNEx_jwtimport.png" position="flex-start" size="80" width="902" height="355" initialPath="images/jwtimport.png" githubPath="HTML5/ps-vtm-userguide/images/jwtimport.png" showCaption="false" indent="1"}

### Generate Private-Public Key Pair

To generate private-public key pair on vTM:

1. Navigate to **Catalogs > JWT > Generate**.
2. Enter the **Name**.

:::hint{type="info"}
Name should be unique, and it should not match with other key names in JWT Private-Public Key Catalog.
:::

3. Select either **RSA** or **EC** from Algorithm drop-down box.
4. Select Key options as per **RSA** or **EC** from Key Options drop-down box.
5. Click **Generate**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/e9BZKsR2-h6j-RyU7Lpq1_jwtgen.png" position="flex-start" size="80" width="900" height="341" initialPath="images/jwtgen.png" githubPath="HTML5/ps-vtm-userguide/images/jwtgen.png" showCaption="false" indent="1"}

### Configure HMAC Secret Key

To configure HMAC secret key:

1. Navigate to **Catalogs > JWT > HMAC**.
2. Enter the **Name**.
3. Select **Hash Size** from Algorithm drop-down.
4. Select **Shared Key** is in base64 format check-box if shared key is in base64 encoded format.
5. Enter the **Shared Key** in Text Box.
6. Click **Configure Key**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/Gee9f9TdbuDOr7H-YZYJ7_jwthmac.png" position="flex-start" size="80" width="867" height="712" initialPath="images/jwthmac.png" githubPath="HTML5/ps-vtm-userguide/images/jwthmac.png" showCaption="false" indent="1"}

### Delete Key

To delete the key on vTM:

1. Navigate to **Catalogs > JWT**.
2. Expand the Keys section to see the list of configured keys.
3. Select the Key you want to delete and click **Edit**.
4. In the Delete page, check **Confirm** box and Click **Delete Key**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/w8D4sY3FNJrS7YfLoC0tA_jwtdelete.png" position="flex-start" size="80" width="902" height="590" initialPath="images/jwtdelete.png" githubPath="HTML5/ps-vtm-userguide/images/jwtdelete.png" showCaption="false" indent="1"}