JWT Authorization Without Interactive Login
GET /api/authorizeByJWT.do
Obtains an API authorization code in a private deployment with JWT trust configured. It does not require a prior Bearer access_token.
URL Query Parameters
| Parameter | Description |
|---|---|
response_type |
Required; code |
client_id |
Required developer application ID |
jwt_token |
Required signed JWT, generated by a trusted server with the agreed claims and secret |
email |
Target email; choose one of the identity fields |
phone |
Target phone number |
babelId |
Target employee identifier |
The source permits an enterprise administrator identity when no user is supplied. Explicitly specify the intended user and verify the caller may act for them. Do not rely on this omission behavior. A signed JWT does not encrypt its payload.
Result and Next Step
On success, obtain success and the authorization code, then call Get token. Here code is an authorization code, not the numeric business error field.
See API overview for claims, HS256 signing and secret configuration. Keep real credentials out of public logs and frontend code.