Header - AD-Service-Token

Last update: March 5, 2025
NOTE
The content on this page is provided for information purposes only. Usage of this API requires a current license from Adobe. No unauthorized use is permitted.

Overview

The AD-Service-Token request header contains the unique user identifier as JWS obtained from an identity service running outside of Adobe Pass Authentication systems.

This header is designed for use in single sign-on (SSO) enabled flows leveraging the Service Token method.

For more details about the single sign-on (SSO) enabled flows leveraging the Service Token method, refer to the Single sign-on using service token flows documentation.

Syntax

AD-Service-Token: <unique_user_identifier>
Header TypeRequest header
StandardNo

Directives

unique_user_identifier

The JSON Web Signature (JWS) which is a signed JSON Web Token (JWT) containing unique user identifier information.

The JWT has the following attributes:

AttributeDescription
issThe unique identifier associated with the entity that offers the application an external identity service to achieve single sign-on (SSO).
subThe unique identifier for the user as returned by the external identity service.
audThe audience, which should be "Adobe".
iatThe issued at timestamp for the present JWT.
expThe expiration timestamp for the present JWT.

The JWT must be signed using SHA256withRSA algorithm.

The JWT must be signed with a private key, part of a pair of RSA private key - public key managed by the external identity service.

The public key of that pair must be handed over to Adobe Pass Authentication in order to be able to recognise JWT tokens signed with the aforementioned private key.