Documentation / Authentication

JWT Auth

JWT Authentication

Use JWT auth when your app exchanges username/password for a JWT and then expects that token in the Authorization: Bearer ... header on every subsequent request — the standard for modern API and SPA architectures.

Tip: if you don't control the login flow (e.g. it requires a callback), grab the JWT manually and inject it as Custom auth instead.

Before you start

You'll need:

  • The login URL and the JSON body shape it expects.
  • Username and password stored in your Key Vault *(Azure)* or Secret Manager *(AWS / GCP)*.
  • The logout URL *(so the scanner doesn't invalidate its own token).*
  • A regex or JSON path that points to the JWT in the login response (e.g. body.token).

Walk through the PAC Wizard up to the authentication step before continuing.

Step 1 — Open the auth page

!Auth screen with method picker

Pick JWT as the authentication type and select the vault holding your credentials.

Step 2 — Fill in the JWT auth fields

| Field | Sample | Notes |

| ------- | -------- | ------- |

| Authentication Type | JWT | |

| Key Vault | Any vault the connector can reach | Holds username / password. |

| Login URL | https://sample.com/login | Where credentials are POSTed. |

| Logout URL | https://sample.com/logout | Excluded from scanning. |

| Login Body Template | {"username":"%username%","password":"%password%"} | Body sent to login. Placeholders replaced from the vault. |

| Username / Password | Vault key names | Pick from dropdown. |

!Filled-in JWT auth form

Generated PAC YAML

Collection: shahin_test
ConnectionName: shahin_test_connector
CloudType: azure
ApplicatioName: sample application
RiskLevel: safe
Compliance: [CIS]
ApplicationType: WebScan
Schedule: onetime
Target: https://samople.com
Scanner:
  Cloud:
    Platform:
      Azure:
        ContainerInstance:
          AfterRun: delete
          NewContainerInstance:
            External:
              SubscriptionId: a6941677-4c37-42fb-960c-dad8f25060a3
              ResourceGp: pac
              Region: eastus
              ContainerGroupName: prancer-scanner-group
              ContainerName: prancer-pentest-instance
              ResourceName: prancer-instances
AuthenticationMethod: jwtAuthentication
Authentication:
  JWTAuth:
    UsernameSecretKey: testJuiceUsername
    PasswordSecretKey: testJuicePassword
    LoginUrl: https://sample.com/login
    LogoutUrl: https://sample.com/logout
    LoginBodyTemplate: '{"username":"%username%","password":"%password%"}'
    LoginIndicator: ^.*token.*$
    AuthorizationType: Header
    AuthorizationKey: Authorization
    AuthorizationTokenType: Bearer
  Vault:
    Azure:
      KeyVaultName: shahinKeyVault123Test
      SubscriptionID: a6941677-4c37-42fb-960c-dad8f25060a3
      Region: westus
      ResourceGp: shahin-test

Extra fields explained

| Field | Notes |

| ------- | ------- |

| LoginIndicator | Regex *or* JSON path. For { body: { token: ... } }, use body.token. |

| AuthorizationType | Header (typical) or Body. |

| AuthorizationKey | Usually Authorization. |

| AuthorizationTokenType | Usually Bearer. Can be empty. |

Tip: the LoginIndicator is the single most common cause of failed authenticated scans. If your app returns the token at data.access_token, set it to data.access_token — not a regex.

Next steps