@salesforce/b2c-tooling-sdk / auth / JwtOAuthStrategy
Class: JwtOAuthStrategy
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:84
OAuth 2.0 JWT Bearer authentication strategy.
Implements RFC 7523 (JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants).
Key differences from client credentials flow:
- Uses public/private key pair instead of client secret
- Sends JWT as
client_assertionin POST body (not Authorization header) - JWT is self-signed and short-lived (60 seconds)
Example
const strategy = new JwtOAuthStrategy({
clientId: 'my-client-id',
certPath: './cert.pem',
keyPath: './key.pem',
accountManagerHost: 'account.demandware.com',
});
const response = await strategy.fetch('https://api.example.com/data');Implements
Constructors
Constructor
new JwtOAuthStrategy(
config):JwtOAuthStrategy
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:103
Creates a new JwtOAuthStrategy instance.
Validates the provided configuration and caches the private key during construction to avoid repeated file I/O during token requests.
Parameters
config
JWT OAuth configuration containing clientId, certificate/key file paths, and Account Manager host
Returns
JwtOAuthStrategy
Throws
Error if clientId, certPath, keyPath, or accountManagerHost are missing
Throws
Error if certificate or key files do not exist, are unreadable, or have invalid PEM format
Throws
Error if the private key is encrypted but no passphrase is provided, or the passphrase is incorrect
Methods
fetch()
fetch(
url,init):Promise<Response>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:219
Performs a fetch request with JWT Bearer authentication. Automatically injects the Authorization header with a fresh access token. Includes 401 retry logic and x-dw-client-id header.
Parameters
url
string
init
FetchInit = {}
Returns
Promise<Response>
Implementation of
getAccessTokenForCascade()
getAccessTokenForCascade(
candidates):Promise<string>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:281
Resolves a scope cascade. See AuthStrategy.getAccessTokenForCascade. Mirrors OAuthStrategy.getAccessTokenForCascade for the JWT bearer flow.
Parameters
candidates
string[][]
Returns
Promise<string>
Implementation of
AuthStrategy.getAccessTokenForCascade
getAuthorizationHeader()
getAuthorizationHeader():
Promise<string>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:249
Returns the Authorization header value for legacy clients.
Returns
Promise<string>
Implementation of
AuthStrategy.getAuthorizationHeader
getJWT()
getJWT():
Promise<DecodedJWT>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:257
Gets the decoded JWT payload.
Returns
Promise<DecodedJWT>
getTokenResponse()
getTokenResponse(
signal?):Promise<AccessTokenResponse>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:324
Gets the full token response including expiration and scopes. Useful for commands that need to display or return token metadata.
Parameters
signal?
AbortSignal
Returns
Promise<AccessTokenResponse>
invalidateToken()
invalidateToken():
void
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:344
Invalidates cached tokens, forcing re-authentication on next request.
Clears every token for this client/AM-host JWT identity — not just the base-scope key — so a 401 retry can't re-use a rejected token cached under a merged cascade-scope key.
Returns
void
Implementation of
withAdditionalScopes()
withAdditionalScopes(
additionalScopes):JwtOAuthStrategy
Defined in: packages/b2c-tooling-sdk/src/auth/oauth-jwt.ts:269
Creates a new JwtOAuthStrategy with additional scopes merged in. Used by clients that have specific scope requirements.
Parameters
additionalScopes
string[]
Scopes to add to this strategy's existing scopes
Returns
JwtOAuthStrategy
A new JwtOAuthStrategy instance with merged scopes