JWT
Authenticate runtime clients with signed tokens and optionally bind claims to payload or certificate identity.
JWT authentication lets a sender or query consumer present a signed token. ReportPlane validates the token using the client's configured JWT secret.
Secret source
A client can use:
- a ReportPlane-generated secret; or
- a customer-provided secret.
Generated secrets are shown only during the appropriate creation/configuration flow. Store them securely and do not expect to retrieve the plain value later.
Send the token
Use the supported bearer authorization header:
Authorization: Bearer YOUR_JWT
Do not place tokens in query strings. URLs are more likely to be stored in logs, browser history, and intermediary telemetry.
Claims and identity binding
Authentication proves that the token was signed correctly. Identity binding can additionally require a chosen JWT claim to agree with a payload field or mTLS identity.
Examples include binding a customer claim to account_id or requiring JWT and certificate identity to match.
Rotation
Plan rotation so applications can move to the replacement without an uncontrolled outage. Use separate clients per environment and application to keep the blast radius small.
Common failures
- missing or malformed bearer header;
- token signed with the wrong secret;
- expired or otherwise invalid token;
- claim missing for the configured identity-binding rule;
- claim value disagrees with payload or certificate identity;
- client disabled or requested resource outside scope.