DocumentationExperience Cloud KCS

Resolving JWT credential expiration and migrating AEM integrations to OAuth Server-to-Server

Last update: June 27, 2026

AEM integrations that still authenticate with Service Account (JWT) credentials fail as those credentials are deprecated and disabled across Adobe Developer Console. JWT credentials stopped being creatable in mid-2024 and stop functioning entirely after the Adobe-mandated cutoff, so any integration still relying on them fails authentication once its public key expires or Adobe disables JWT. AEM products now support OAuth Server-to-Server credentials, which must replace every JWT-based flow. Adding an OAuth Server-to-Server credential to each affected project, switching the AEM IMS configuration to use it, validating the flows, and then deleting the JWT credentials restores uninterrupted access.

Description description

Environments:

  • Adobe Experience Manager as a Cloud Service (AEMaaCS)
  • AEM Managed Services
  • AEM 6.5 on-premises
  • AEM Assets Essentials and Brand Portal
  • Adobe Developer Console

Issue/Symptoms:

  • Adobe email notifications arrive about an upcoming or completed Service Account (JWT) credential migration or deprecation.
  • Access token requests return HTTP 404 or HTTP 400 when calling legacy JWT endpoints, such as https://example.com/oauth/token.
  • The Last Access Token Generated At timestamp in Adobe Developer Console doesn’t update after expected application runs.
  • AEM integrations with Analytics, Target, Launch, Brand Portal, or Smart Tags fail to authenticate after JWT removal.
  • New JWT credentials can’t be created in Adobe Developer Console.

Root cause:

Adobe has deprecated Service Account (JWT) credentials in Adobe Developer Console. JWT credentials stopped being creatable as of June 3, 2024, and stop functioning on or after January 27, 2025 (dates vary slightly for Cloud Manager projects). Existing integrations that still rely on JWT tokens fail authentication when their public keys expire or when Adobe disables JWT. AEM products now support OAuth Server-to-Server credentials, which must replace all JWT-based authentication flows. After migrating to OAuth, deleting the old JWT credentials is safe — but there’s no rollback once deletion occurs.

How to confirm

  1. Identify all projects using JWT credentials. In Adobe Developer Console, review the projects flagged with Has Service Account (JWT) credential or an Attention required banner.
  2. Check whether each JWT credential is still actively used. Open the credential and note the Last Access Token Generated At timestamp; a recent timestamp indicates an active integration still using JWT. If you’re unsure which system uses it, search your codebase for references to JWT private key files or JWT token-generation libraries.

Resolution resolution

  1. Add an OAuth Server-to-Server credential to each affected project. In Adobe Developer Console, open a JWT-using project, click Add new credential under the migration banner, and select OAuth Server-to-Server. Both JWT and OAuth credentials then appear in the project and remain active, and the OAuth credential lists a Client ID with active scopes.

  2. Update your application or AEM integration to use OAuth Server-to-Server:

    • On AEMaaCS, configure OAuth via the AEMaaCS IMS setup and ensure integrations like Target, Analytics, or Launch use the OAuth-based IMS configuration.
    • On AEM 6.5 (Managed Services or on-premises), go to Tools > Security > Adobe IMS Configurations, edit the existing JWT-based configuration, and switch the authentication type to OAuth Credentials.

Confirm the IMS integration status shows successful token retrieval. If it fails, confirm the OAuth scopes in Developer Console match the AEM configuration requirements.
3. Validate OAuth authentication before deleting JWT credentials. Trigger the workflows or AEM functionality that previously relied on JWT — Smart Tags, Brand Portal sync, or Analytics/Target integrations — and monitor the logs for successful OAuth token retrieval.
4. Delete the JWT credentials only after migration succeeds. In Developer Console, once OAuth is fully functional, click Review & delete to remove the JWT credentials. The project then lists only OAuth credentials and the warning emails stop. If deletion is blocked, confirm no automated process is still calling the JWT endpoints.

Validation

  1. Confirm Adobe Developer Console no longer lists JWT credentials for the project unless intentionally retained.
  2. Trigger an end-to-end API call (such as a Smart Tag request, an Analytics/Target integration, or a Cloud Manager API call) and confirm the access tokens are generated using OAuth.
  3. Review the AEM logs to confirm the JWT token-generation code paths are no longer called.
recommendation-more-help
experience-cloud-kcs-help-kbarticles