Request a JWT for Experience Edge

Experience Edge for XM provides the following APIs that help you administer your Edge tenant and provide access to your content:

Delivery API - GraphQL API that provides access to your published content.
Token API - REST API that enables you to manage the API keys used to access the Delivery API.
Admin API - REST API that enables you to configure your Edge tenant.

Note

You can also request a JWT for the Authoring and Management API or the Deploy API.

Authorizing your requests

To interact with the Experience Edge APIs, you must authorize your requests depending on the API you want to use.

Delivery API

To authorize your requests to the Delivery API, you must generate an Edge token and include it in every call to the API. You can generate an Edge token in any of the following ways:

Using the Deploy app.
Using the Deploy REST API. To do this, you must first request a JSON web token (JWT) for Experience Edge.
Using the Token API. To do this, you must first request a JSON web token (WT) for Experience Edge.

Request a JWT

Before you begin

Create an Edge administration client to obtain a client ID and client secret. You'll use the client ID and client secret when requesting a JWT.

To request a JSON web token (JWT) for Experience Edge, make the following HTTP request using either a JSON or a URL-encoded format:

POST https://auth.sitecorecloud.io/oauth/token

You must provide the following required attributes in the request body:

Attribute	Type	Description	Value
`audience`	`string`	The group of APIs the JWT is intended for.	`https://api.sitecorecloud.io`
`grant_type`	`string`	The method used to obtain the JWT.	`client_credentials`
`client_id`	`string`	The client ID of your Edge administration client. If you don't know this value, first create an Edge administration client.	Your client ID. Example: `or27P5db...`
`client_secret`	`string`	The client secret of your Edge administration client. If you don't know this value, first create an Edge administration client.	Your client secret. Example: `ctrWEP7Rd3...`

JSON

RequestResponse

curl -X POST 'https://auth.sitecorecloud.io/oauth/token' \
-H 'Content-Type: application/json' \
--data-raw '{
    "audience": "https://api.sitecorecloud.io",
    "grant_type": "client_credentials",
    "client_id": "<YOUR_CLIENT_ID>",
    "client_secret": "<YOUR_CLIENT_SECRET>"
}'

RequestResponse

{
    "access_token": "eyJhbG...",
    "scope": "...",
    "expires_in": 86400,
    "token_type": "Bearer"
}

In the response:

access_token contains the JWT. You can use the JWT to:
- Generate an Edge token using the Deploy REST API or the Token API. This lets you authorize your requests to the Delivery API.
- Authorize requests to the Token API or Admin API.
scope contains the resources the JWT provides access to. The resources depend on the type of credentials you created.
expires_in contains the validity of the JWT in seconds. Note that JWTs typically expire in 24 hours. After that time, the token is no longer valid and you must request a new token.
token_type contains the type of token created, such as Bearer.

XM Cloud is now SitecoreAI

Some code examples, images, and UI labels may still use XM Cloud while engineering assets are being updated.

Do you have some feedback for us?

If you have suggestions for improving this article,