---
title: JWT Request Flow
slug: kronpam-reference-guide-3-9-0/jwt-request-flow
docTags: 
createdAt: 2026-10-10T10:14:23.340Z
---

The calling application first authenticates to Microsoft Entra ID. PAM does not receive the calling application credential.

1.      Request an access token. The calling application sends its own Client ID and credential to the Microsoft Entra ID token endpoint with grant\_type=client\_credentials and the protected resource scope followed by /.default.

2.      Receive the signed JWT. Microsoft Entra ID returns an access token containing the intended Audience, caller identity, validity period, and assigned application roles.

3.      Call the AAPM password endpoint. The calling application sends the standard AAPM request and adds Authorization: Bearer \<jwt>.

4.      Validate the request. PAM verifies the token signature and claims, checks the Application Token policy, resolves the permitted Vault Account, and returns the secret only when every check passes.

:::hint{type="warning"}
Do not confuse the two Client IDs. The protected resource Application (client) ID belongs in the Microsoft Entra integration. The calling application Client ID belongs in the Application Token.
:::