Access token format

The issuer access token is required for the issuer application to start a D1 SDK login session.

It is in the form of a JSON Web Token (JWT) where the token contains a set of JSON header and payload claims that are signed using a private key. The JWT claims and their signatures are validated during the login session.

Access token header

Claims

JWT Header Parameters	Type	Required	Description
kid	string	Yes	Identifies the key used to sign the JWT.
typ	string	No	Identifies the media type. Use "JWT".
alg	string	Yes	Defines the algorithm used to sign the JWT.

Example

access-token-header.json

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "iss1_kid"
}

Access token payload

JSON schema

JWT payload claim	Type	Required	Description
exp	integer	Yes	Expiration time as a Unix timestamp, in seconds. After this time, D1 rejects the JWT.
scope	string	Yes	Space-separated scopes used to authorize access. Configure these during D1 onboarding. D1 maps them to internal operation scopes. Example: digibank:mobilebanking digibank:ecommerce.
aud	string or array[string]	Yes	Identifies the recipients that the JWT is intended for. D1 validates this claim with the following format: https://{D1-client-api-domain-name}/oidc/{issuerId}.
jti	string	Yes	Unique identifier for the JWT.
iss	string	Yes	Issuer of the JWT. For the client binding use case, set this to issuerId. If the access token public key is provisioned in the tenant configuration, set this to issuerId for single-issuer and multi-issuer tokens. If it is not provisioned, then for single-issuer tokens only, set this to the jwks_uri value from /.well-known/openid-configuration, where D1 downloads the access token public key.
sub	string	Yes	Identifies the authenticated subject. Set this to consumerId.
iat	integer	Yes	Timestamp at which the JWT was issued.
cbp	string	Conditional	Client Binding Payload. Required when client binding is enabled. Set this value exactly as returned by the D1 SDK binding hash API call.

Example (single consumer ID)

access-token-payload.single-consumerid.json

{
  "jti": "M9JHKtLdfXu782EH3hMf_",
  "sub": "testuser",
  "iat": 1626836247,
  "exp": 1627441047,
  "scope": "digibank:mobilebanking digibank:ecommerce",
  "iss": "tenant1",
  "aud": "https://client-api.d1.thalescloud.io/oidc/tenant1"
}

Example (multiple consumer IDs)

The sub field can contain space-separated consumer IDs.

access-token-payload.multiple-consumerids.json

{
  "jti": "M9JHKtLdfXu782EH3hMf_",
  "sub": "testuser1 testuser2",
  "iat": 1626836247,
  "exp": 1627441047,
  "scope": "digibank:mobilebanking digibank:ecommerce",
  "iss": "tenant1",
  "aud": "https://client-api.d1.thalescloud.io/oidc/tenant1"
}

Example (client binding enabled)

Include the cbp claim when client binding is enabled.

access-token-payload.client-binding.json

{
  "jti": "M9JHKtLdfXu782EH3hMf_",
  "sub": "testuser",
  "iat": 1626836247,
  "exp": 1627441047,
  "scope": "digibank:mobilebanking digibank:ecommerce",
  "iss": "tenant1",
  "aud": "https://client-api.d1.thalescloud.io/oidc/tenant1",
  "cbp": "<client binding payload returned by the SDK API>"
}

For the full client binding flow, see SDK login.

Algorithms

Supported and recommended

• ES256: ECDSA using P-256 & SHA-256
• ES384: ECDSA using P-384 & SHA-384
• ES512: ECDSA using P-512 & SHA-512

Supported

• RS256: RSASSA-PKCS1-v1_5 using SHA-256
• RS512: RSASSA-PKCS1-v1_5 using SHA-512
• PS256: RSASSA-PSS
• PS384: RSASSA-PSS
• PS512: RSASSA-PSS
• EdDSA (Ed25519)