Skip to content
Postman API Testing Tips

How To Generate Jwt Token Using Private Key In Postman

API Testing Blog

Generating JWT Tokens with Private Keys in Postman

JSON Web Tokens (JWTs) are a standard method for securely transmitting information between parties. They are frequently used for authentication and authorization in APIs. When employing JWTs, it’s crucial to use a private key to sign the token, ensuring its authenticity and integrity. This guide will walk you through the process of generating JWT tokens using a private key within Postman, providing practical examples and step-by-step instructions.

Understanding JWTs and Private Keys

JWTs consist of three parts separated by dots (.):

  1. Header: Contains metadata about the token, including the algorithm used for signing.
  2. Payload: Carries the actual information, such as user claims or permissions.
  3. Signature: A cryptographic signature generated using a secret key, ensuring the token’s integrity.

Private Keys are used to digitally sign the JWT, guaranteeing its authenticity. They are kept secret and should never be shared publicly.

Generating a JWT Token with a Private Key in Postman

Here’s a comprehensive guide on generating JWT tokens using a private key in Postman:

  1. Prepare Your Private Key:

    • You’ll need to have your private key in a suitable format (e.g., PEM). If you haven’t yet created a private key, you can use OpenSSL or other tools to generate one.
    • Save the private key file (e.g., private.pem) in a secure location.

  2. Install the JWT Decoder Postman Collection:

    • In Postman, navigate to the “Postman Collections” section.

    • Click “Import” and import the “JWT Decoder” collection publicly available on the Postman Network.

  3. Create a New Request in Postman:

    • From the “JWT Decoder” collection, choose the “JWT Generate” request.
    • This request provides pre-configured options for token generation using a private key.

  4. Populate the Request with Key Information:

    • In the “Authorization” tab, select “Bearer Token”.
    • Configure the request body as follows:
      • alg: “RS256” (typically recommended for secure applications).
      • typ: “JWT” (specifies the token type).
      • keyId: The identifier for your private key (if available).
      • payload: JSON object containing the data you wish to include in the token (e.g., user information, claims).

  5. Upload Your Private Key:

    • Use the “Upload File” option within the request body to select your private key file (private.pem).

  6. Generate the JWT Token:

    • Send the request.
    • The response will contain the successfully generated JWT token.

Decoding and Verifying JWT Tokens

Once you’ve generated the token, you can decode and verify it using Postman’s built-in JWT decoder functionality or the “JWT Decoder” collection.

  1. Using Postman’s Built-in Decoder:

    • Go to the “Authorization” tab of your request.
    • Click the “Decode JWT” button.
    • Postman will display the token’s header, payload, and signature.

  2. Using the “JWT Decoder” Collection:

    • Choose the “JWT Decode” request from the “JWT Decoder” collection.
    • Paste the generated JWT into the request body.
    • Send the request.
    • The response will provide a detailed breakdown of the decoded token data.

Example Code for Payload and Private Key

// Sample Payload
{
  "iss": "YOUR_ISSUER",
  "sub": "YOUR_USER_ID",
  "aud": "YOUR_AUDIENCE",
  "exp": 1698199038, // Expiry time (in seconds)
  "iat": 1698195438  // Issued at timestamp (in seconds)
}


// Sample Private Key (PEM Format)
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDc9G4Lq+A46t/
... (Your actual private key content)
...
-----END PRIVATE KEY-----

Conclusion

Generating JWT tokens with private keys in Postman allows secure communication and authentication in your API applications. This guide provided you with a comprehensive understanding of the process, from preparing and uploading your key to decoding the generated tokens for verification. By implementing these steps, you can effectively enhance security and manage sensitive information in your API interactions using JWTs.

API Testing Blog