> For the complete documentation index, see [llms.txt](https://dev.ishare.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev.ishare.eu/version-2.2/reference/ishare-jwt/client-assertion.md).

# Client Assertion

{% hint style="info" %}
***This page must be considered part of the iSHARE Framework***

*This page is considered normative and is therefore compliant with RFC 2119.*
{% endhint %}

This page defines the JWT payload that should be provided to generate an iSHARE JWT client assertion for the [access token endpoint.](https://gitlab.com/ishare-foundation/cab/developer-portal/-/blob/v2.2/all-roles-common-endpoints/access-token-m2m%20\(1\).md)

## JWT Payload

Instead of the default [iSHARE JWT ](/version-2.2/reference/ishare-jwt.md)payload requirements, the following apply:

* The `iss` and `sub` claims MUST contain a valid [Party Identifier](https://framework.ishare.eu/detailed-descriptions/functional/functional-requirements-per-role/party-identification) of the client that wishes to authenticate.
* The `aud` claim MUST contain only a valid [Party Identifier](https://framework.ishare.eu/detailed-descriptions/functional/functional-requirements-per-role/party-identification) of the party that authenticates the client. Including multiple audiences creates a risk of impersonation and is therefore not allowed.

In OAuth 2.0 clients are generally pre-registered. Since in iSHARE servers interact with clients that may have been previously unknown, this is not a workable requirement. Therefore iSHARE implements a generic client identification and authentication scheme, based on iSHARE whitelisted PKIs.

Since OAuth 2.0 doesn’t specify a PKI based authentication scheme, but OpenID Connect 1.0 does, iSHARE chooses to use the scheme specified by OpenID Connect in all use cases. This is preferred above defining a new proprietary scheme.

Example Client Assertion JWT Payload:

```json
{
  "iss": "did:ishare:EU.NL.NTRNL-10000001",
  "sub": "did:ishare:EU.NL.NTRNL-10000001",
  "aud": "did:ishare:EU.NL.NTRNL-10000000",
  "jti": "378a47c4-2822-4ca5-a49a-7e5a1cc7ea59",
  "exp": 1504683475,
  "iat": 1504683445
}
```