DocumentationExperience Cloud KCS

Document generation failures in Adobe Experience Manager as a Cloud Service

Last update: October 2, 2026

In Adobe Experience Manager as a Cloud Service, document generation workflows can fail when IMS authentication does not return an access token. As a result, document generation and integrations with downstream services stop working, and workflow execution fails. To fix this issue, renew the JWT certificate and restore successful IMS token exchange.

Description description

Environment

Adobe Experience Manager (AEM) as a Cloud Service (Production environment)

Symptoms

  • Document generation (such as casebuild, masterapp, and brochure) fails in the production environment.
  • Integration with Adobe Sign or other downstream services fails.
  • Application logs show HTTP 400 errors on POST requests to /ims/exchange/jwt at the IMS endpoint.
  • No access token is returned from IMS, and errors such as NullPointerException related to missing access tokens appear in logs.

Cause

The JWT certificate used for service-to-service authentication has expired or has been revoked. As a result, the IMS token exchange fails, no access token is returned, and document generation and related workflows fail.

Resolution resolution

Follow the steps below to resolve the issue.

  1. Generate a new private key and client secret for your integration.
  2. Update the JWT certificate for the technical account in Adobe Developer Console (Cloud Console).
  3. Update your application’s configuration to reference the new credential set (private key, client secret, and certificate).
  4. Redeploy your application through the Cloud Manager pipeline to ensure that all publish pods receive the updated credentials.
  5. After deployment, verify that the application uses the new certificate to sign JWTs and not the expired certificate.
  6. Test document generation (such as casebuild, masterapp, and brochure) to confirm successful completion.
  7. Remove or revoke the expired certificate and associated secrets from the technical account to maintain security.
recommendation-more-help
experience-cloud-kcs-help-kbarticles