How to get the JWT id_token?

[22Viig]

Written in the documentation:

When a user logs in, Auth0 returns three items:

access_token: to learn more, see the Access Token documentation id_token: to learn more, see the ID Token documentation expires_in: the number of seconds before the Access Token expires You can use these items in your application to set up and manage authentication.

How can I get the id_token ? I need the encoded JWT . Thanks

[stevehobbsdev]

Hi @22Viig,

I think this part should probably be omitted from the quickstart documentation, thanks for the heads up.

You cannot retrieve the ID token from the SDK, as it's not a recommended thing to do (see this issue on the matter and why we won't be exposing it without a good use-case.

What's the situation in which you need the ID token?

[22Viig]

I need the JWT to send it to an api server that implements jwt authentication mechanism (mechanism that uses the same key and algorithm of Auth0 to decrypt the jwt ). The server is an API server for mongodb, created with RESTHeart.

The idea is to let my users get authenticated on my website via Auth0, get the id_token and call the api server (passing the id_token/jwt) to get some data.

Maybe can I call some auth0 api to get the id_token?

[stevehobbsdev]

@22Viig If it's just a JWT you need, you can send the access token. You can get this from the SDK using the getTokenSilently function. I've had a quick look through the RESTHeart docs and I can't see anywhere where it says that you need the ID token specifically, so this should work for you.

To get an access token in JWT format from Auth0, you need to supply an audience parameter when creating the Auth0 client. Everything you need should be in this tutorial for calling APIs. The only difference is that you're calling someone else's API instead of your own, so you can skip the parts about creating your own Express server.

Hope that helps!

[22Viig]

Thanks @stevehobbsdev , I used the getTokenSilently function with the audience in the auth configuration the get the JWT. I have still a couple of questions to you

1. why if i paste the access token (in the JWT format) in the https://jwt.io/ it says Invalid Signature?
2. which is the algorithm used to encode the JWT? it should be HS256, but in the tutorial is written to create an API using the RS256 algorithm, it's confusing

[stevehobbsdev]

@22Viig

1. Unsure without looking at the token. Which signature algorithm are you using?
2. The algorithm that's used is dependent on your Auth0 app settings. In there, you can configure it to use either HS256 or (the default) RS256. I would check the app you're connecting to in order to see what algorithm is being used.

It should be noted though, that auth0-spa-js only supports tokens using the RS256 algorithm.