JAR Requirement - CRITICAL
Last updated
Last updated
📖 Getting started? Check the Integration Flow Overview to understand the complete integration process.
🔧 Need complete implementation guide? See JAR Complete Implementation Guide for detailed examples in multiple languages.
Oten Identity Provider has different requirements based on your client type:
JAR is REQUIRED for all authorization requests
Traditional OAuth 2.0 query parameters will be rejected
Must use HS256 or EdDSA signing
JAR is FORBIDDEN (cannot securely store signing keys)
PKCE is REQUIRED instead
Use direct authorization parameters
See PKCE Implementation Guide for details
Error you'll get for confidential clients:
Note: Public clients (SPAs/Mobile) should use direct parameters with PKCE instead of JAR.
For immediate implementation:
If you're currently using traditional OAuth 2.0:
For complete migration examples, see JAR Complete Implementation Guide
If you encounter errors, check these common issues:
For detailed error troubleshooting, see Common Errors
Before testing, ensure:
For complete validation checklist, see JAR Complete Implementation Guide
Remember:
Oten IDP supports JAR only by default. However, if your application cannot implement JAR due to technical constraints, please contact our support team to enable traditional OAuth flow for your specific use case.
Include in your request:
Security Notice: Traditional OAuth flow has lower security compared to JAR. It should only be used as a temporary solution while planning JAR implementation.
Security: Prevents parameter tampering and injection attacks
Integrity: Ensures request parameters cannot be modified in transit
Authentication: Verifies the request comes from a legitimate client
Key Management: Confidential clients can securely store signing keys
HS256
Client Secret
Development, Internal Apps
EdDSA
Ed25519 Key Pair
Production, Public Apps
Choose your method:
HS256: Use your client secret (easier)
EdDSA: Generate key pair (more secure)
Get complete examples:
Copy working code for your language
Before: Send OAuth parameters as URL query parameters
After: Send OAuth parameters inside a signed JWT
Keep your existing OAuth flow logic
Add JAR creation step before authorization redirect
Replace query parameters with JAR token
invalid_request (Missing request parameter)
You're missing request parameter - implement JAR
invalid_request_object
Check your signing algorithm and keys
invalid_request (JAR expired)
Set JAR expiration to ≤ 5 minutes
Prerequisites - JAR setup requirements
JAR Complete Implementation Guide - Detailed examples in multiple languages
Step 3: Authorization Flow - Complete JAR implementation
Configuration Reference - Endpoints and settings
Common Errors - JAR-related error troubleshooting
← Previous: Prerequisites - Environment setup
↑ Overview: Integration Flow Overview - See the big picture
→ Next: Step 1: Choose OAuth Library - Select JAR-compatible library
JAR is required for confidential clients
PKCE is required for public clients
JAR is forbidden for public clients
📧 Contact Support: support@oten.dev
Application details and technical constraints
Reason why JAR cannot be implemented
Security measures you have in place
Timeline for potential JAR migration
See JAR Complete Implementation Guide
Test your implementation:
Use development environment first
Verify JAR structure with debugging tools