Migration from JWT to OAuth Server-to-Server in AEM IMS integration | Community
Skip to main content
Level 2
August 15, 2025
Solved

Migration from JWT to OAuth Server-to-Server in AEM IMS integration

  • August 15, 2025
  • 1 reply
  • 235 views

Hi folks,

If JWT authentication is deprecated for Adobe IMS integration in AEM as a Cloud Service, is there a migration path or documentation showing how to replace JWT with OAuth Server-to-Server in AEM code (for example, replacing ServicePrincipalCredentials with an OAuth-based flow)?

Best answer by SantoshSai

Hi @navyavo,

Yes - Adobe has officially deprecated Service Account (JWT) authentication for IMS integrations. The recommended replacement is OAuth Server-to-Server credentials.

Migration steps for your reference:

  1. In Adobe Developer Console, create new OAuth Server-to-Server credentials for your AEM project.

  2. Update your AEM code to request access tokens using the new client ID, client secret, and technical account details instead of ServicePrincipalCredentials.

  3. Use Adobe’s IMS token endpoint:

    POST https://ims-na1.adobelogin.com/ims/token/v3 Content-Type: application/x-www-form-urlencoded grant_type=client_credentials client_id=... client_secret=... scope=...
  4. Replace any JWT signing logic with a direct OAuth token request.

Reference:

1 reply

SantoshSai
Community Advisor
SantoshSaiCommunity AdvisorAccepted solution
Community Advisor
August 15, 2025

Hi @navyavo,

Yes - Adobe has officially deprecated Service Account (JWT) authentication for IMS integrations. The recommended replacement is OAuth Server-to-Server credentials.

Migration steps for your reference:

  1. In Adobe Developer Console, create new OAuth Server-to-Server credentials for your AEM project.

  2. Update your AEM code to request access tokens using the new client ID, client secret, and technical account details instead of ServicePrincipalCredentials.

  3. Use Adobe’s IMS token endpoint:

    POST https://ims-na1.adobelogin.com/ims/token/v3 Content-Type: application/x-www-form-urlencoded grant_type=client_credentials client_id=... client_secret=... scope=...
  4. Replace any JWT signing logic with a direct OAuth token request.

Reference:

Santosh Sai