Hello, Guys welcome back learn How to Create JSON Web Token (JWT) with Google Apps Script. You can use Google Script to generate JSON Web Tokens (JWT) that can be used to secure routes, allowing only authorised requests with a valid token to connect to the APIs (e.g., the Zoom API).
JSON Web Tokens are made up of three parts:
- The header containing the hash algorithm used for signing and decrypting the JWT.
- The payload, which is in JSON format and comprises all of the user data. The iat and exp properties denote the issue date and expiration time, respectively, although the payload can accept any data.
- The signature data that allows APIs to validate the access token’s authenticity.
The sections are separated by a dot (period), and the data is encoded in Base64 using the Utilities. Apps Script’s base64EncodeWebSafe function.
Create JSON Web Token
const createJwt = ({ privateKey, expiresInHours, data = {} }) => {
// Sign token using HMAC with SHA-256 algorithm
const header = {
alg: 'HS256',
typ: 'JWT',
};
const now = Date.now();
const expires = new Date(now);
expires.setHours(expires.getHours() + expiresInHours);
// iat = issued time, exp = expiration time
const payload = {
exp: Math.round(expires.getTime() / 1000),
iat: Math.round(now / 1000),
};
// add user payload
Object.keys(data).forEach(function (key) {
payload[key] = data[key];
});
const base64Encode = (text, json = true) => {
const data = json ? JSON.stringify(text) : text;
return Utilities.base64EncodeWebSafe(data).replace(/=+$/, '');
};
const toSign = `${base64Encode(header)}.${base64Encode(payload)}`;
const signatureBytes = Utilities.computeHmacSha256Signature(
toSign,
privateKey
);
const signature = base64Encode(signatureBytes, false);
return `${toSign}.${signature}`;
};
Generate Token with your Private Key & Payload
const generateAccessToken = () => {
// Your super secret private key
const privateKey =
'ZPYu33tz8QYU3hwJQXgHpZsKfYn0r2poopBx7x1n3rmeIvuGU4wf65kk6rV1DrN';
const accessToken = createJwt({
privateKey,
expiresInHours: 6, // expires in 6 hours
data: {
iss: Session.getActiveUser().getEmail(),
userId: 123,
name: 'Amit Agarwal',
},
});
Logger.log(accessToken);
};
You can paste the generated access token in jwt.io and you’ll be able to see the content (payload) of the decoded token. Please note that if the token has invalid signature data, the payload may still be decoded as it is encoded in Base64.

Decoding JWT Payload with Google Apps Script
const parseJwt = (jsonWebToken, privateKey) => {
const [header, payload, signature] = jsonWebToken.split('.');
const signatureBytes = Utilities.computeHmacSha256Signature(
`${header}.${payload}`,
privateKey
);
const validSignature = Utilities.base64EncodeWebSafe(signatureBytes);
if (signature === validSignature.replace(/=+$/, '')) {
const blob = Utilities.newBlob(
Utilities.base64Decode(payload)
).getDataAsString();
const { exp, ...data } = JSON.parse(blob);
if (new Date(exp * 1000) < new Date()) {
throw new Error('The token has expired');
}
Logger.log(data);
} else {
Logger.log('🔴', 'Invalid Signature');
}
};
If you are new to JWT, the video tutorials by Kyle Cook here and here are a good place to start.