JWT generation example - Bastion

If you prefer to generate JWTs programmatically within your Python application or tooling, you can use the following lightweight script. It constructs the required JWT claims and signs the token using your ES256 private key.

Step 1: Generate your private key

Before running the script, securely generate your ES256 private and public keys. For testing purposes you can use this command:

openssl ecparam -name prime256v1 -genkey -noout -out es256-private.pem
openssl ec -in es256-private.pem -pubout -out es256-public.pem

Step 2: Script to generate a JWT

import jwt
import json
import datetime
import hashlib

# Required inputs
method = "POST"
url = "/v2/accounts"
body = "{\n \"request_id\": \"2de34f56-d549-5651-af61-e2316bc3c47a\",\n \"identity_id\": \"2zwoDFH1yR9ofx1DFHqNDNL2aFS\"\n}"

# Loaded EC private key object (ES256)
# This assumes PRIVATE_KEY is already loaded

hashedBody = hashlib.sha256(body.encode()).hexdigest()

# Generate timestamp
timestamp = datetime.datetime.now(datetime.UTC).timestamp()

# Construct claims
claims = {
    "iat": int(timestamp),
    "req-method": method,
    "req-path": url,
    "body": hashedBody
}

# Sign JWT using ES256
token = jwt.encode(claims, PRIVATE_KEY, algorithm="ES256")

The resulting token variable contains the signed JWT string, which you can include in your API request header like so:

bastion-signature: <your-signed-jwt>

Notes

The iat claim must reflect the current UTC time and be within 30 seconds of server time.
The body must match the exact order and structure of the request body.
The script does not skip the body claim for GET or HEAD

Related topics

Request signing with JWTs API authentication overview Wallet key management Product updates Sandbox vs. production environments

⌘I