Bearer Token

Prerequisites

Before implementing this flow, ensure you have:

Construct the Endpoint URL

The Bearer Token (SSO Session) endpoint is always accessed via POST over HTTPS.

1
url = f'{gatewayUrl}/api/v1/sso-sessions'

Assemble the JWT Header and Claims

1
now = math.floor(time.time())
2
header = {
3
    'alg': 'RS256',
4
    'typ': 'JWT',
5
    'kid': f'{clientKeyId}'
6
}
7
claims = {
8
    'ip': ip,
9
    'credential': f'{credential}',
10
    'iss': f'{clientId}',
11
    'exp': now + 86400,
12
    'iat': now
13
}

Implementation note: this claim set is produced by the same compute_client_assertion() helper documented in the Access Token step, branching on the target url. Confirm your implementation routes to the {gatewayUrl}/api/v1/sso-sessions branch, not the token endpoint branch, when building this assertion.

Base64URL-Encode the Header and Claims

1
json_header = json.dumps(header, separators=(',', ':')).encode()
2
encoded_header = base64_encode(json_header)
3
json_claims = json.dumps(claims, separators=(',', ':')).encode()
4
encoded_claims = base64_encode(json_claims)
5
payload = f"{encoded_header}.{encoded_claims}"

This reuses the same base64_encode() helper and base64url encoding rules (strip padding, substitute -/_) as the Access Token step — see that guide for details. Consistency here matters: any deviation in JSON serialization or encoding between steps will produce a structurally valid but unverifiable JWS.

Sign the Payload with RSA-SHA256

1
md = SHA256.new(payload.encode())
2
signer = PKCS1_v1_5.new(jwtPrivateKey)
3
signature = signer.sign(md)
4
encoded_signature = base64_encode(signature)

Process:

1. Encode the payload (encoded_header.encoded_claims) to UTF-8 bytes.
2. Compute the SHA-256 digest.
3. Sign the digest using PKCS#1 v1.5 padding with the same RSA private key used throughout the flow.
4. Base64URL-encode the raw signature bytes.

Assemble the Client Assertion (JWS)

1
assertion = payload + "." + encoded_signature

As in the Access Token step, this produces a complete compact JWS:

base64url(header) . base64url(claims) . base64url(signature)

Unlike the Access Token step, this assertion is not wrapped in a client_assertion form field — it is transmitted as the raw request body, as shown next.

Construct the Authorization Header and Request Body

1
headers = {
2
    "Authorization": "Bearer " + access_token,
3
    "Content-Type": "application/jwt"
4
}
5
signed_request = assertion

This differs structurally from the Access Token step, which conveyed its assertion as one field within a form-encoded body and required no Authorization header at all. Here, both an Authorization header and a JWT body are required simultaneously — mixing bearer-token authentication with a signed-assertion payload.

Execute the Request and retrieve the session access_token

1
bearer_request = requests.post(url=url, headers=headers, data=signed_request)
2
print(web_header_print(bearer_request))
3
4
if bearer_request.status_code == 200:
5
    return bearer_request.json()["access_token"]
6
return

The request body is the raw JWS string (data=signed_request), sent with Content-Type: application/jwt. On success, the response JSON contains an access_token field — do not confuse this with the OAuth2 access token from the previous step; this value represents the established SSO gateway session and is the credential used for subsequent authenticated Client Portal / streaming requests (e.g. via websocket). A non-200 response returns None in the reference implementation; production code should inspect the response body and status code for actionable error details rather than failing silently.