--- title: "How to Set Up and Use JWT" slug: "using-jwt" description: "Learn how to configure and use JSON Web Tokens (JWT) in Decisions to extract token data and include it in API calls." updated: 2026-06-08T20:37:59Z published: 2026-06-08T20:37:59Z canonical: "documentation.decisions.com/using-jwt" --- > ## Documentation Index > Fetch the complete documentation index at: https://documentation.decisions.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Set Up and Use JWT ## Overview [JWT (JSON Web Token)](https://jwt.io/introduction) is a web-based token format utilized for transferring information between devices in the form of a JSON object. It serves as a secure means of transmitting data between parties in a compact and self-contained structure. JWTs are commonly employed to reference and securely transmit user context session data between clients and servers. In Decisions, JWTs represent a user's session. The token will expire once the user's session is no longer valid. Using External JWT to Access DecisionsIf you wish to use external OAuth JWT to access the Decisions API, users must configure JWT Access in the application. For more information, refer to the article [API and Authentication](https://documentation.decisions.com/version-10/docs/api-and-authentication#jwt-authorization-type).  --- ## JWT Flow Steps JWT functionality within Flows can be found in the [**Call Internal Decisions Service step**](https://documentation.decisions.com/step-library/docs/call-internal-decisions-service). Select service AccountService. There are two relevant methods: 1. LoginAndGetJWTToken 2. GetContextFromJWTToken #### Login and Get JWT Token 1. This Flow step takes in the username and password as inputs and uses the default shared key, located in **System > Settings Integration Settings**, hashes that account information with the algorithm, which then outputs the token. 2. The **Login and Get JWT Token** uses the user login of an Account and then outputs. 3. Any account that can log in to the Portal can be the account to be used for obtaining a token. ![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/image-1780405142132.png) How to Change JWT Secret Key This secret key can be changed by typing in a new key in the integration settings. It is found under **System > Settings > Integration Settings**. Breaking Change: JWT Secret KeyJSON Web Tokens that are using the default key will break. Users should modify the key before upgrading. #### Get Context From JWT Token This method takes in a JWT as an input and then outputs five pieces of information: | **SessionValue:** | The user session of the Account running the Flow. | | --- | --- | | **ClientEventSessionId:** | Ties session updates to what is being seen on a browser page. | | **DisplayType:** | Refers to Silverlight, HTML, HTMLmobile, or HTMLtablet. | | **StudioPortal:** | This property will be set to true if the user Account is a studio user. | | **BrowserUserAgent:** | Refers to the string that browsers use to determine their behavior. | Below is an example of the output of the step, highlighting the returned values: ![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/image-1780669179399.png) #### Changing Passwords If an account's password changes, the token will still be valid and usable. To invalidate a JWT at the same time as a password change, go to **System > System Settings > Portal Settings** and select Forcibly Close Sessions When Password Changed. ![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/image-1780410725865.png) --- ## Get JWT Token In An API Call 1. To Access JWT token through an API, a call needs to be made to the [Account Service](https://documentation.decisions.com/version-10/docs/decisions-core-services) methods **LoginAndGetJWTToken, Validate Token, Context Token, and Get JWKS**: ```shell http://{BasePortalURL}/Decisions/Primary/REST/AccountService/LoginAndGetJWTToken?outputType=JSON&userName=example@decisions.com&password=example ``` 2. To find the **BasePortalURL**, open a web browser. Alternatively, the BasePortalURL can be found by searching for the **BasePortalUR**L in the [Settings.xml](/version-10/docs/system-settings-overview-settings-xml). 3. The **BasePortalURL** will usually be the first two fields after the "**http://".** By default, local installs of Decisions will usually be "http://localhost/decisions" or "http://localhost" if it is a root install. 4. In production environments, it may be "https://CompanyDNSname.com/decisions" or "https://CompanyDNSname.com/" if it is a root install.   **![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/image-831.png)** 5. For local installs, this is how a call would look like:  ![JWTOVERVIEW1 (1).png](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/JWTOVERVIEW1%20%281%29.png) 6. Next, select the Authorization header tab and input the following in the following fields: 1. **Type**: “Bearer Token” 2. **Token**: “Paste JWT Token Here”![JWTOVERVIEW1 (6).png](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/image-1746476053049.png) --- ## Calling APIs to run Flow/Rule/Report Once a JWT token is created, calls can be made to access Flows, Rules, and Reports. Below is an example highlighting accessing a specific flow on localhost. 1. **URL**: `http://{BasePortalURL}/Decisions/Primary/?FlowId={FlowId/ReportId/RuleId/TruthTableId}&Action=api&outputtype=JSON` 2. **HTTP Header**: Authorization: Bearer (JWT token) 3. For instance, this is how a call to run a Flow with id `f5cc8ed9-216e-11ea-888b-b42e996c6738 `looks like on the localhost. ![JWTOVERVIEW1 (5).png](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/JWTOVERVIEW1%20%285%29.png) --- ## 3rd-Party External JWT The Call Internal Decisions Services step has a method called GetExternalJwtUsedForLogin. This can be used to get the external JWT that was used for a particular login. This is often used for additional authentication. --- For further information on Integrations, visit the [Decisions Forum](https://community.decisions.com/categories/Integrations).