Create a JWT Manually

Review these steps if you’d prefer to create a JWT manually without using the JWT Tool.

Example decoded header

The PUBLIC_KEY_ID shown in the example is the one you generated while setting up DPC sandbox credentials. See Create a public key.

{
  "alg": "RS384",
  "kid": "{PUBLIC_KEY_ID}"
}

Example decoded payload

{
  "iss": "{CLIENT_TOKEN}",
  "sub": "{CLIENT_TOKEN}",
  "aud": "https://sandbox.dpc.cms.gov/api/v1/Token/auth",
  "exp": {EXPIRATION_TIMESTAMP},
  "jti": "{JWT_ID}"
}

Note

EXPIRATION_TIMESTAMP is a Unix timestamp in seconds, not an ISO 8601 string. Cannot be more than 5 minutes in the future.
JWT_ID can be any string, but needs to be unique for every JWT you create.

Validate your JWT

The /Token/validate endpoint lets you submit your Signed JWT for validation.

Example request

POST /api/v1/Token/validate

Example cURL command

curl 'https://sandbox.dpc.cms.gov/api/v1/Token/validate' \
    -H 'Accept: application/json' \
    -H 'Content-Type: text/plain' \
    -d '{SIGNED_JWT}'

curl 'https://sandbox.dpc.cms.gov/api/v1/Token/validate' \
    -H 'Accept: application/json' \
    -H 'Content-Type: text/plain' \
    -d '{SIGNED_JWT}'

The API will return 200 OK if the JWT is valid. If not it will return an error message.