OIC - How to Generate JWT CID Token with SHA256 Hash in Oracle Integration Cloud (OIC)

🔐 How to Generate JWT CID Token with SHA256 Hash in Oracle Integration Cloud (OIC)

🧩 Use Case

As part of secure API integration with HSBC (or any financial institution requiring strict identity/authentication enforcement), the client must send a JWT (JSON Web Token) as a CID (Client Identification Token) in the Authorization header of each API request. This token includes a signed hash (SHA-256) of the payload body to ensure message integrity.

This post walks you through how to:

• Construct the JWT token using base64 encoded header and payload.
• Generate the SHA256 hash of the payload body.
• Sign the token using a private key  and java oci function.
• Assemble and use the CID token in OIC integration.

Overall high level Steps: 

1. Send the CID token to the vendor.

2. Generate CID JWT token.

Step1: Send JWT token to the Vendor:

Headers:

Standard:

• Authorization : JWS <CID Token> 
• Accept-Language : en-GB 
• Content-Type : application/json 

Custom:

• X-Forwarded-For : <IP Address> Metadata/Environment/baseURL
• X-HSBC-Chnl-CountryCode : HK 
• X-HSBC-Chnl-Group-Member : HBAP
• X-HSBC-Global-Channel-Id : PARTNER
• X-HSBC-Request-Correlation-Id : JTI
• X-HSBC-Client-Id :client name

Request:

• Salt
• MessageBody
• Sugnature

Step2: Generate CID JWT token.

🏗️ JWT Structure

Format:

JWT token = BASE64URL(JWT Header) + "." + BASE64URL(JWT Body) + "." + BASE64URL(Signature)

🔐 OIC Implementation Steps

1. Configure trigger for common service to generate token
2. Write payload data required for hashing
3. Write JWT Header data
4. Write JWT Body data with hashing
5. Remove base64 padding training chars from JWT header and body data
6. Call the common function to create signature
7. Generate JWR token and share 

Step1: Configure trigger:

Request Payload

{

  "ParentProcessId": "",

  "InterfaceId": "INTXXX",

  "Data": {

    "Salt": "XXXXXXXXXX",

    "MessageBody": "XXXXXXXXXXXXXX",

    "Signature": "XXXXXXXXXXXXXXXXXXXXxxx"

  }

}

Response Payload

{

  "cidToken": "Encrypted Message",

  "iat": "1750411716",

  "jti": "91be275c-a920-4ef9-ac39-1dbe3f50372d",

  "payload_message": ""

}

Step2: Write Payload data required for hashing

Step3: Write JWT header data

Example:

{

  "ver":"1.0",

  "typ": "JWT",

  "alg": "RS256",

  "kid": "XYZ"

}

Step4: Write JWT body with hashing

Create payload data for hashing:

{"Salt":"","MessageBody":"","Signature"}

Example payload:

{

  "sub": "CLP",

  "aud": "EPS",

  "payload_hash_alg": "SHA-256" or "RSASHA256",

  "payload_hash": "<hash from JS function>",

  "iat": 1750411716,

  "jti": "91bee275c-a920-4ef9-ac39-1dbe3f50372d"

}

Used custom checksum function to create hash key for the payload data stored in the stage. Use below blog for details:

https://soalicious.blogspot.com/2026/08/oic-generate-sha-256-checksum-using.html

For iat : use below blog to generate teh unix time.

https://soalicious.blogspot.com/2025/04/oic-converting-normal-datetime-to-unix.html

Step5: Remove base64 padding training chars from JWT header and body data

See my below blog for more details:

https://soalicious.blogspot.com/2026/08/oic-removing-base64-padding-for-jwt.html

Step6: Create signature(sign/verify):

Messgae passed as concat of "encode base64 url jwt header data" , "." ,"emcode base64 url jwt body data"

Step7: create JWT token and send back as resposne to the caller service.

Jwt token : base64 url(header) . Base64url(body).Base64Url(signature)

Payload message: same sent as received in step2

Follow below blog for java function code - sign / verify using RSA private and public key pair.

https://soalicious.blogspot.com/2026/04/oic-rsa-sign-and-verify-java-code-for.html

---

✅ Final Output

A complete CID token is structured like:

JWS eyJ2ZX...<Header>.eyJzdW...<Payload>.X1c8Cp...<Signature>

It is passed to the Authorization header like:

Authorization: JWS eyJ2ZX...<Signature>

---

🧪 Testing & Validation

• Use Postman or SoapUI to validate the generated JWT.
• Tools like jwt.io help decode and verify token.
• Ensure OIC has access to private key and correct time sync for iat.