> For the complete documentation index, see [llms.txt](https://docs.payments.thalescloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.payments.thalescloud.io/3d-secure/ja/d1-sdkwosuru/hajimeni/5.-ren-zheng/akusesutkun.md).

# アクセストークン形式

The issuer access token is required for the issuer application to start a D1 SDK login session.

It is in the form of a JSON Web Token (JWT) where the token contains a set of JSON header and payload claims that are signed using a private key. The JWT claims and their signatures are validated during the login session.

### Access token header

{% tabs %}
{% tab title="Claims" %}

<table><thead><tr><th width="209.00006103515625">JWT Header Parameters</th><th>Type</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><code>kid</code></td><td>string</td><td>Yes</td><td>Identifies the key used to sign the JWT.</td></tr><tr><td><code>typ</code></td><td>string</td><td>No</td><td>Identifies the media type. Use <code>"JWT"</code>.</td></tr><tr><td><code>alg</code></td><td>string</td><td>Yes</td><td>Defines the algorithm used to sign the JWT.</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}
{% code title="access-token-header.json" %}

```json
{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "iss1_kid"
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

### Access token payload

{% tabs %}
{% tab title="JSON schema" %}

<table><thead><tr><th>JWT payload claim</th><th>Type</th><th width="88.666748046875">Required</th><th>Description</th></tr></thead><tbody><tr><td><code>exp</code></td><td>integer</td><td>Yes</td><td>Expiration time as a Unix timestamp, in seconds. After this time, D1 rejects the JWT.</td></tr><tr><td><code>scope</code></td><td>string</td><td>Yes</td><td>Space-separated scopes used to authorize access. Configure these during D1 onboarding. D1 maps them to internal operation scopes. Example: <code>digibank:mobilebanking digibank:ecommerce</code>.</td></tr><tr><td><code>aud</code></td><td>string or array[string]</td><td>Yes</td><td>Identifies the recipients that the JWT is intended for.<br>D1 validates this claim with the following format:<br><code>https://{D1-client-api-domain-name}/oidc/{issuerId}</code>.</td></tr><tr><td><code>jti</code></td><td>string</td><td>Yes</td><td>Unique identifier for the JWT.</td></tr><tr><td><code>iss</code></td><td>string</td><td>Yes</td><td><p>Issuer of the JWT. For the client binding use case, set this to <code>issuerId</code>.</p><p>If the access token public key is provisioned in the tenant configuration, set this to <code>issuerId</code> for single-issuer and multi-issuer tokens.</p><p>If it is not provisioned, then for single-issuer tokens only, set this to the <code>jwks_uri</code> value from <code>/.well-known/openid-configuration</code>, where D1 downloads the access token public key.</p></td></tr><tr><td><code>sub</code></td><td>string</td><td>Yes</td><td>Identifies the authenticated subject. Set this to <code>consumerId</code>.</td></tr><tr><td><code>iat</code></td><td>integer</td><td>Yes</td><td>Timestamp at which the JWT was issued.</td></tr><tr><td><code>cbp</code></td><td>string</td><td>Conditional</td><td>Client Binding Payload. Required when client binding is enabled. Set this value exactly as returned by the D1 SDK binding hash API call.</td></tr></tbody></table>
{% endtab %}

{% tab title="Example (single consumer ID)" %}
{% code title="access-token-payload.single-consumerid.json" %}

```json
{
  "jti": "M9JHKtLdfXu782EH3hMf_",
  "sub": "testuser",
  "iat": 1626836247,
  "exp": 1627441047,
  "scope": "digibank:mobilebanking digibank:ecommerce",
  "iss": "tenant1",
  "aud": "https://client-api.d1.thalescloud.io/oidc/tenant1"
}
```

{% endcode %}
{% endtab %}

{% tab title="Example (multiple consumer IDs)" %}
The `sub` field can contain space-separated consumer IDs.

{% code title="access-token-payload.multiple-consumerids.json" %}

```json
{
  "jti": "M9JHKtLdfXu782EH3hMf_",
  "sub": "testuser1 testuser2",
  "iat": 1626836247,
  "exp": 1627441047,
  "scope": "digibank:mobilebanking digibank:ecommerce",
  "iss": "tenant1",
  "aud": "https://client-api.d1.thalescloud.io/oidc/tenant1"
}
```

{% endcode %}
{% endtab %}

{% tab title="Example (client binding enabled)" %}
Include the `cbp` claim when client binding is enabled.

{% code title="access-token-payload.client-binding.json" %}

```json
{
  "jti": "M9JHKtLdfXu782EH3hMf_",
  "sub": "testuser",
  "iat": 1626836247,
  "exp": 1627441047,
  "scope": "digibank:mobilebanking digibank:ecommerce",
  "iss": "tenant1",
  "aud": "https://client-api.d1.thalescloud.io/oidc/tenant1",
  "cbp": "<client binding payload returned by the SDK API>"
}
```

{% endcode %}

For the full client binding flow, see [SDK login](https://app.gitbook.com/o/fwy1mtbRONGA2YDKDBr0/s/62lLFDcmLCeqqwmy4Fee/integrate-d1-sdk/getting-started/configuration/5.-authentication/sdk-login).
{% endtab %}
{% endtabs %}

### Algorithms

#### Supported and recommended

* ES256: ECDSA using P-256 & SHA-256
* ES384: ECDSA using P-384 & SHA-384
* ES512: ECDSA using P-512 & SHA-512

#### Supported

* RS256: RSASSA-PKCS1-v1\_5 using SHA-256
* RS512: RSASSA-PKCS1-v1\_5 using SHA-512
* PS256: RSASSA-PSS
* PS384: RSASSA-PSS
* PS512: RSASSA-PSS
* EdDSA (Ed25519)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.payments.thalescloud.io/3d-secure/ja/d1-sdkwosuru/hajimeni/5.-ren-zheng/akusesutkun.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.