Access Token

Prerequisites

Before implementing this flow, ensure you have:

Construct the Endpoint URL

The Access Token endpoint is always accessed via POST over HTTPS, using application/x-www-form-urlencoded content.

1
url = f'{oauth2Url}/api/v1/token'
2
headers = {
3
    "Content-Type": "application/x-www-form-urlencoded"
4
}

Assemble the JWT Header and Claims

1
now = math.floor(time.time())
2
header = {
3
    'alg': 'RS256',
4
    'typ': 'JWT',
5
    'kid': f'{clientKeyId}'
6
}
7
claims = {
8
    'iss': f'{clientId}',
9
    'sub': f'{clientId}',
10
    'aud': f'{audience}',
11
    'exp': now + 20,
12
    'iat': now - 10
13
}

Implementation note: compute_client_assertion() is a shared helper reused later for the Bearer Token step, where it builds a different claim set (ip, credential, exp of 24 hours) based on the target url. Only the branch matching {oauth2Url}/api/v1/token is relevant to this step.

Base64URL-Encode the Header and Claims

1
def base64_encode(val):
2
    return base64.b64encode(val).decode().replace('+', '-').replace('/', '_').rstrip('=')
3
4
json_header = json.dumps(header, separators=(',', ':')).encode()
5
encoded_header = base64_encode(json_header)
6
json_claims = json.dumps(claims, separators=(',', ':')).encode()
7
encoded_claims = base64_encode(json_claims)
8
payload = f"{encoded_header}.{encoded_claims}"

Implementation details:

1. Both header and claims are serialized to compact JSON (no whitespace) before encoding, to ensure a deterministic byte representation.
2. Encoding uses base64url (per RFC 4648 §5), not standard base64 — + and / are substituted with - and _, and trailing = padding is stripped. This is required by the JWS compact serialization spec, and standard base64.b64encode output must be manually converted, as shown.
3. The header and claims segments are joined with a literal . to form the unsigned payload.

Sign the Payload with RSA-SHA256

1
md = SHA256.new(payload.encode())
2
signer = PKCS1_v1_5.new(jwtPrivateKey)
3
signature = signer.sign(md)
4
encoded_signature = base64_encode(signature)

Process:

1. Encode the payload (encoded_header.encoded_claims) to UTF-8 bytes.
2. Compute the SHA-256 digest.
3. Sign the digest using PKCS#1 v1.5 padding with your RSA private key (jwtPrivateKey — a Crypto.PublicKey.RSA key object).
4. Base64URL-encode the raw signature bytes using the same encoding helper as the header/claims — not standard base64.

Assemble the Client Assertion (JWS)

1
assertion = payload + "." + encoded_signature

Concatenating encoded_header, encoded_claims, and encoded_signature with . separators produces the compact JWS serialization:

base64url(header) . base64url(claims) . base64url(signature)

This full string is the client_assertion value submitted in the token request. It is self-contained and stateless — no separate signing request or nonce exchange is required, unlike the OAuth 1.0a Request Token flow.

Construct the Token Request Body

1
form_data = {
2
    'client_assertion_type': 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
3
    'client_assertion': assertion,
4
    'grant_type': 'client_credentials',
5
    'scope': scope
6
}

Unlike the OAuth 1.0a Request Token step, no Authorization header is used here — all credentials are conveyed via the signed assertion in the form body.

Execute the Request and retrieve the access_token

1
token_request = requests.post(url=url, headers=headers, data=form_data)
2
print(web_header_print(token_request))
3
4
if token_request.status_code == 200:
5
    access_token = token_request.json()["access_token"]

The request is sent as a standard form-encoded POST; the signed assertion inside form_data carries all authentication material. The returned access_token should be retained for the subsequent Bearer Token / SSO Session step — it is passed as a Bearer credential in that request’s Authorization header and is not a long-lived credential; treat it as scoped to the immediate session-establishment exchange.