---
title: Requesting a Vault Secret with a JWT
slug: kronpam-reference-guide-3-9-0/requesting-a-vault-secret-with-a-jwt
docTags: 
createdAt: 2026-10-10T13:36:57.405Z
---

### Obtain the Access Token

The calling application sends a POST request to the Microsoft Entra ID token endpoint for its tenant. It uses grant\_type=client\_credentials, its own Client ID, its own credential, and the scope \<protected-resource-application-id-uri>/.default. Microsoft Entra ID returns access\_token; this value is the signed JWT supplied to PAM.

### Call the Existing AAPM Password Endpoint

The integration uses the existing GET endpoint /aioc-rest-web/rest/aapm/request/password. The workload continues to send the standard AAPM account parameters for the configured Vault Account. Instead of relying on a Kron token for authentication, it sends Authorization: Bearer \<jwt>.