Skip to content

update on links #179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 31, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions src/pages/guides/authentication/JWT/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@

<InlineAlert slots="text"/>

The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration.md).
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration).

To establish a secure service-to-service Adobe I/O API session, you must create a JSON Web Token (JWT) that encapsulates the identity of your integration, and then exchange it for an access token. Every request to an Adobe service must include the access token in the `Authorization` header, along with the API Key (Client ID) that was generated when you created the [Service Account Integration](../service-account-integration.md) in the [Adobe Developer Console](https://developer.adobe.com/console/).
To establish a secure service-to-service Adobe I/O API session, you must create a JSON Web Token (JWT) that encapsulates the identity of your integration, and then exchange it for an access token. Every request to an Adobe service must include the access token in the `Authorization` header, along with the API Key (Client ID) that was generated when you created the [Service Account Integration](../service-account-integration) in the [Adobe Developer Console](https://developer.adobe.com/console/).

## Authentication Workflow

Expand All @@ -22,7 +22,7 @@ Your JWT must contain the following claims:
| iss | _Required_. The issuer, your **Organization ID** from the Adobe Developer Console integration, in the format `org_ident@AdobeOrg`. Identifies your organization that has been configured for access to the Adobe I/O API.|
| sub | _Required_. The subject, your **Technical Account ID** from the Adobe Developer Console integration, in the format: `[email protected]`.|
| aud | _Required_. The audience for the token, your **API Key** from the Adobe Developer Console integration, in the format: `https://ims-na1.adobelogin.com/c/api_key`.|
| Metascopes | _Required_. The API-access claim configured for your organization: [JWT Metascopes](scopes.md), in the format: `"https://ims-na1.adobelogin.com/s/meta_scope": true`|
| Metascopes | _Required_. The API-access claim configured for your organization: [JWT Metascopes](scopes), in the format: `"https://ims-na1.adobelogin.com/s/meta_scope": true`|

The following is a sample payload to be signed and encoded.

Expand All @@ -40,7 +40,7 @@ The following is a sample payload to be signed and encoded.

The JWT must be signed and base-64 encoded for inclusion in the access request. The JWT libraries provide functions to perform these tasks.

- The token must be signed using the private key for a digital signing certificate that is associated with your API key. You can associate more than one certificate with an API key. If you do so, you can use the private key of any associated certificate to sign your JWT. For more information about private key/public certificate, see [Create a public key certificate](./jwt-certificate.md#using-the-public-key-certificate-for-service-account-integration).
- The token must be signed using the private key for a digital signing certificate that is associated with your API key. You can associate more than one certificate with an API key. If you do so, you can use the private key of any associated certificate to sign your JWT. For more information about private key/public certificate, see [Create a public key certificate](./jwt-certificate#using-the-public-key-certificate-for-service-account-integration).

**Algorithm**: **RS256** (RSA Signature with SHA-256) is an asymmetric algorithm, and it uses a public/private key pair: the identity provider has a private (secret) key used to generate the signature, and the consumer of the JWT (i.e. Adobe Developer Console) gets a public key to validate the signature.

Expand Down
2 changes: 1 addition & 1 deletion src/pages/guides/authentication/JWT/jwt-certificate.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<InlineAlert slots="text"/>

The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md).
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration).

Create a private key and a public certificate. Make sure you store these securely.

Expand Down
4 changes: 2 additions & 2 deletions src/pages/guides/authentication/JWT/samples.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

<InlineAlert slots="text"/>

The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md).
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration).

The following samples demonstrate JWT generation and exchanging it with Adobe IMS endpoint to retrieve an access token.

Expand All @@ -20,4 +20,4 @@ The following samples demonstrate JWT generation and exchanging it with Adobe IM
[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-dotnet) where you can find a complete sample C#.NET code to generate a JWT and exchanging it with Adobe IMS Endpoint to retrieve an access token.

### PHP Example
[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-php) where you can find PHP code example for JWT creation and reference method that exchanges JWT with Adobe IMS Endpoint to retrieve an access token.
[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-php) where you can find PHP code example for JWT creation and reference method that exchanges JWT with Adobe IMS Endpoint to retrieve an access token.
2 changes: 1 addition & 1 deletion src/pages/guides/authentication/JWT/scopes.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

<InlineAlert slots="text"/>

The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md).
The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration).

JSON Web Token (JWT) metascopes govern the access and privileges for service accounts. As an application developer, you will choose the set of scopes to access certain resources by specifying the scopes as part of the encoding claims for your JWTs.

Expand Down
2 changes: 1 addition & 1 deletion src/pages/guides/authentication/OAuth/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@

<InlineAlert slots="text"/>

The information on this page has been moved to our [user authentication guide](../UserAuthentication/index.md).
The information on this page has been moved to our [user authentication guide](../UserAuthentication/).
2 changes: 1 addition & 1 deletion src/pages/guides/authentication/OAuth/samples.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@

<InlineAlert slots="text"/>

The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation.md#standard-oauth2-libraries).
The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation#standard-oauth2-libraries).
2 changes: 1 addition & 1 deletion src/pages/guides/authentication/OAuth/scopes.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@

<InlineAlert slots="text"/>

The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation.md#oauth-20-scopes).
The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation#oauth-20-scopes).
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,12 @@ A credential is used to uniquely identify your integration to Adobe. To use an A

### Will my Adobe integrations or applications stop working immediately?

No. Any integration or application using the Service Account (JWT) credential will continue to work until June 30, 2025. See [deprecation timelines](./migration.md#deperecation-timelines). See section on [migration next steps](#migration-next-steps).
No. Any integration or application using the Service Account (JWT) credential will continue to work until June 30, 2025. See [deprecation timelines](./migration#deperecation-timelines). See section on [migration next steps](#migration-next-steps).



### What is the deadline to migrate to the new credential?
You must migrate your application to use the new OAuth Server-to-Server credential before June 30, 2025, to ensure your application does not face any downtime. See [deprecation timelines](./migration.md#deperecation-timelines). See [migration guide](./migration.md).
You must migrate your application to use the new OAuth Server-to-Server credential before June 30, 2025, to ensure your application does not face any downtime. See [deprecation timelines](./migration#deperecation-timelines). See [migration guide](./migration).



Expand All @@ -48,7 +48,7 @@ After June 30, 2025, you can no longer refresh certificates for integrations usi
Furthermore, Adobe will automatically convert Service Account (JWT) to OAuth Server-to-Server credentials when certificates expire or on March 1, 2026, whichever comes first.

### We can currently create new Service Account (JWT) credentials even though they are marked as deprecated. Is it recommended?
No. Creating any new Service Account (JWT) credentials is not recommended. All Service Account (JWT) credentials, whether old or new, will stop working after June 30, 2025. We recommend you avoid migrating your application again and use the new OAuth Server-to-Server credential from the beginning. See our [implementation guide](./implementation.md).
No. Creating any new Service Account (JWT) credentials is not recommended. All Service Account (JWT) credentials, whether old or new, will stop working after June 30, 2025. We recommend you avoid migrating your application again and use the new OAuth Server-to-Server credential from the beginning. See our [implementation guide](./implementation).



Expand All @@ -58,25 +58,25 @@ No. Creating any new Service Account (JWT) credentials is not recommended. All S


### What are the benefits of using the OAuth Server-to-Server credential?
You can read more about OAuth Server-to-Server credentials in our [implementation guide](./implementation.md). You can view the comparison between the OAuth Server-to-Server credential and the Service Account (JWT) credential [here](./migration.md#why-oauth-server-to-server-credentials).
You can read more about OAuth Server-to-Server credentials in our [implementation guide](./implementation). You can view the comparison between the OAuth Server-to-Server credential and the Service Account (JWT) credential [here](./migration#why-oauth-server-to-server-credentials).




### Can I programmatically rotate certificates for Service Account (JWT) credential?
No such ability is currently available. There are no plans to add such ability either.

Instead, we recommend switching to the new credential that does not use expiring certificates and allows you to [rotate client secrets](./implementation.md#rotating-client-secrets) through the UI and API ([programmatically](./implementation.md#rotating-client-secrets-programmatically)).
Instead, we recommend switching to the new credential that does not use expiring certificates and allows you to [rotate client secrets](./implementation#rotating-client-secrets) through the UI and API ([programmatically](./implementation#rotating-client-secrets-programmatically)).



### Can I programmatically rotate client secrets for OAuth Server-to-Server credentials?
Absolutely. View our guide on rotating client secrets programmatically [here](./implementation.md#rotating-client-secrets-programmatically).
Absolutely. View our guide on rotating client secrets programmatically [here](./implementation#rotating-client-secrets-programmatically).



### What should I do if my client secrets get leaked?
We recommend immediately [rotating your application's client secret](./implementation.md#rotating-client-secrets) and contacting Adobe customer support if you wish to invalidate any existing tokens.
We recommend immediately [rotating your application's client secret](./implementation#rotating-client-secrets) and contacting Adobe customer support if you wish to invalidate any existing tokens.



Expand All @@ -91,7 +91,7 @@ There are primarily three categories of integrations and custom applications tha

These are integrations provided out-of-the-box by Adobe that require a Service Account (JWT) credential to function. Example: Integration between AEM and Adobe Target, Integration between AEM and Adobe Stock, User sync tool, etc.

For these integrations Adobe already supports the OAuth Server-to-Server credentials and allows you to migrate. Apart from our general-purpose [migration guide](./migration.md), you can also refer to the migration guide for [AEM customers](https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/jwt-credentials-deprecation-in-adobe-developer-console) and [User Sync tool customers](https://github.com/adobe-apiplatform/user-sync.py/blob/user-guide-wip/en/user-manual/connect_adobe.md).
For these integrations Adobe already supports the OAuth Server-to-Server credentials and allows you to migrate. Apart from our general-purpose [migration guide](./migration), you can also refer to the migration guide for [AEM customers](https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/jwt-credentials-deprecation-in-adobe-developer-console) and [User Sync tool customers](https://github.com/adobe-apiplatform/user-sync.py/blob/user-guide-wip/en/user-manual/connect_adobe).

2. **Integrations developed by vendors**

Expand All @@ -101,7 +101,7 @@ There are primarily three categories of integrations and custom applications tha

3. **Custom integrations or applications**

These are integrations or application custom developed by an IT/development team in your organization. You are responsible for migrating these integrations. See our general-purpose [migration guide](./migration.md).
These are integrations or application custom developed by an IT/development team in your organization. You are responsible for migrating these integrations. See our general-purpose [migration guide](./migration).



Expand Down Expand Up @@ -129,7 +129,7 @@ There are a few ways to see if a Project is actively being used:

1. Open an impacted Project and view the 'Last service activity' date on the overview page. You can also see this information on the list of Projects page.
2. Visit the Service Account (JWT) credential overview page and look at the last access token generated at timestamp. This will tell you when this Project was last used to generate an access token.
3. Visit the Insights tab in a Project to see recent activity (API calls, Events Delivered, etc.) involving the credentials contained in the Project. See our documentation on [Insights](../../insights.md) to know more.
3. Visit the Insights tab in a Project to see recent activity (API calls, Events Delivered, etc.) involving the credentials contained in the Project. See our documentation on [Insights](../../insights) to know more.



Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@

# OAuth Server-to-Server credential implementation guide

The following guide goes over finer implementation details for OAuth Server-to-Server credentials. At the end of the guide is a list of recommended industry-standard OAuth2 libraries. Before you proceed, we recommend you become familiar with the server to server authentication credentials in our [server to server authentication guide](./index.md)
The following guide goes over finer implementation details for OAuth Server-to-Server credentials. At the end of the guide is a list of recommended industry-standard OAuth2 libraries. Before you proceed, we recommend you become familiar with the server to server authentication credentials in our [server to server authentication guide](./)

## Table of contents
+ [Setting up the OAuth Server-to-Server credential](#setting-up-the-oauth-server-to-server-credential)
Expand All @@ -13,7 +13,7 @@ The following guide goes over finer implementation details for OAuth Server-to-S

## Setting up the OAuth Server-to-Server credential

Depending on the API or an Event to your project on the Adobe Developer Console, you can select the OAuth Server-to-Server credential. The OAuth Server-to-Server credential is available for all APIs and Events supporting the [Service Account (JWT) credential *(deprecated)*](./index.md#service-account-jwt-credential-deprecated).
Depending on the API or an Event to your project on the Adobe Developer Console, you can select the OAuth Server-to-Server credential. The OAuth Server-to-Server credential is available for all APIs and Events supporting the [Service Account (JWT) credential *(deprecated)*](./#service-account-jwt-credential-deprecated).

### Credential Name

Expand Down Expand Up @@ -51,7 +51,7 @@ curl -X POST 'https://ims-na1.adobelogin.com/ims/token/v3' \

Your integration can generate access tokens when needed. However, it is a good practice to cache access tokens for reuse until they expire. Integrations should avoid generating a new access token when a previously generated access token has not expired and can be reused. Adobe can throttle your integration if it generates too many access tokens.

Access tokens usually expire in 24 hours. To check the expiry time of an access token, see the `expires_in` field in the API response returned by the above cURL request. Note: The `expires_in` time is in seconds. See [API reference](./ims.md#fetching-access-tokens).
Access tokens usually expire in 24 hours. To check the expiry time of an access token, see the `expires_in` field in the API response returned by the above cURL request. Note: The `expires_in` time is in seconds. See [API reference](./ims#fetching-access-tokens).

### Generating access tokens using standard OAuth2 libraries

Expand Down
Loading