Allegion Developer Portal

NFC JWT Requirements

NFC JWT Requirements

ID Token · Access Token · Implementation Tips

Last modified: 06.17.2025

Introduction to JWTs for NFC Authentication

JSON Web Tokens (JWTs) are an open standard (RFC 7519) that provide a compact and self-contained way for securely transmitting information between parties as a JSON object. In the context of Schlage Mobile Credentials NFC functionality, JWTs are used for authentication and authorization within the SDK.

The Schlage Mobile SDK requires two types of JWTs for proper authentication:

  1. ID Token - Used to verify the identity of the user
  2. Access Token - Used to authorize access to protected resources

This guide outlines the specific requirements for both token types when implementing NFC functionality with the Schlage Mobile SDK.

ID Token Requirements

The ID Token is used to authenticate the user's identity. It must contain specific claims to be valid for the Schlage Mobile SDK NFC implementation.

Non-Standard Required Claims

  • https://api.allegion.com/email - Custom claim that identifies the user
  • https://api.allegion.com/integrationId - Required if using the standard (non-extended) authentication request for the SDK. The value will be provided by your Allegion representative.
    (See: iOS Auth Request Docs | Android Auth Request Docs)

Field Descriptions

iss (Issuer): The issuer value must be supplied to Allegion during integration setup. This value will be used to validate tokens and must remain consistent.

aud (Audience): For ID tokens, this should be AllegionAccessHub. Note that while AllegionAccessHub is the recommended and standard value, the accepted audience can be flexible if required for specific integration needs.

https://api.allegion.com/email: This custom claim doesn't necessarily need to be an email address, but its value must align with the user ID used when making the Create Access Right API call. This ensures proper association between the token and the user's access rights.

Note that the example JWTs provided contain some common/standard claims for illustrative purposes.

ID Token Example

{
  "iss": "https://your-identity-provider.com",
  "sub": "user123",
  "aud": "AllegionAccessHub",
  "exp": 1718762864,
  "iat": 1718676464,
  "name": "John Doe",
  "email": "john.doe@example.com",
  "https://api.allegion.com/email": "john.doe@example.com",
  "https://api.allegion.com/integrationId": "your-integration-id"
}

Access Token Requirements

The Access Token is used to authorize the user to access specific resources. It contains permissions and scopes that determine what actions the user can perform.

Non-Standard Required Claims

  • https://api.allegion.com/email - Custom claim that identifies the user

Field Descriptions

iss (Issuer): The issuer value must be supplied to Allegion during integration setup. This value will be used to validate tokens and must remain consistent.

aud (Audience): Must be one of the following values depending on your desired vertical and environment:

  • Production: https://api.allegion.com/{your_vertical}
    • e.g., https://api.allegion.com/employeebadge
    • https://api.allegion.com/residentkey
    • https://api.allegion.com/studentid
  • Partner QA: https://api.allegion.com/{your_vertical}/partnerqa
    • e.g., https://api.allegion.com/employeebadge/partnerqa
    • https://api.allegion.com/residentkey/partnerqa
    • https://api.allegion.com/studentid/partnerqa

Note that the example JWTs provided contain some common/standard claims for illustrative purposes.

Access Token Example

{
  "iss": "https://your-identity-provider.com",
  "sub": "user123",
  "aud": "https://api.allegion.com/employeebadge/partnerqa",
  "exp": 1718762864,
  "iat": 1718676464,
  "https://api.allegion.com/email": "john.doe@example.com"
}

Implementation Considerations

When implementing JWT authentication for NFC functionality in the Schlage Mobile SDK:

  • Ensure all required fields are included in both token types
  • The https://api.allegion.com/email claim value must match the user ID used when calling the Create Access Right API — it does not need to be an email address.
  • Maintain proper token expiration and renewal processes
  • Store tokens securely within your application
  • Follow best practices for JWT implementation to prevent common security vulnerabilities

For additional information or assistance with JWT implementation, please contact your Allegion Developer Success representative.