Generate/Verify JWT - Use TLS Keystore to sign

Google Cloud Apigee
1

Hi, a bit of context, when signing a JWT the used field is <SecretKey/Value> with a ‘ref’ usually to retrieve the Secret from a variable that was previously extracted from an encrypted KVM. At least that’s how we usually do it.

I was wondering, can we not use the TLS Keystore to store this private/public certificates? Just in the same way it is done on TargetEndpoints for example, referencing the Keystore and Alias.

I dont see any documentation regarding this, could someone clarify?

Thanks!

2

Hi there @david_de_castro, welcome to the Apigee community and thank you for posting this question!

We encourage our community members and experts to share their knowledge on this topic.

While the community reviews this, you might be interested to know that we have two upcoming Community TechTalks that dive deep into automating security policies, governance configurations, and advanced access hubs:

  • July 16, 2026: Easy AI Gateway pattern using YAML – This session focuses on mapping out completely configuration-driven approaches to seamlessly deliver enterprise security policies behind the scenes.

  • July 23, 2026: Apigee AI Portals for Model, Tool & Agent Self-Service – This session will explore the evolution of central governance, automated security hubs, and self-service registration at scale.

If you haven’t already, feel free to check out the details and reserve your spot on our Community TechTalks!

4

Hi there,

Welcome to the Google Cloud Community! It is great to have you here.

To answer your question regarding using a TLS Keystore directly to sign or verify JSON Web Tokens (JWTs) in Apigee:

Currently, Apigee does not support referencing a TLS Keystore and alias directly from within the GenerateJWT or VerifyJWT policies. Furthermore, for security reasons, there is no runtime API or mechanism to extract private keys from an Apigee TLS Keystore. Using a keystore directly for JWT signing has been a requested feature but remains a backlog item.

The Recommended Workaround

To secure and manage your private/public keys, the standard and most secure approach in Apigee is to use an Encrypted Key Value Map (KVM) or Google Cloud Secret Manager:

  1. Store the Key: Save your PEM-encoded private key as an entry in an encrypted KVM (or Secret Manager).
  2. Retrieve the Key: Use the KeyValueMapOperations policy (or a Secret Manager retrieval step) to load the key into a private variable at runtime (e.g., private.private_key).
  3. Reference the Key: In your GenerateJWT policy, reference that variable in the <PrivateKey> element.

Here is an example of how your GenerateJWT policy should look:

<GenerateJWT name="Generate-JWT-RS256">
    <Algorithm>RS256</Algorithm>
    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
    <PrivateKey>
        <Value ref="private.private_key"/>
    </PrivateKey>
    <Subject>subject-of-the-token</Subject>
    <Issuer>issuer-of-the-token</Issuer>
    <ExpiresIn>1h</ExpiresIn>
</GenerateJWT>

Using this approach ensures that your private keys are completely shielded from trace logs (by using the private. prefix) while providing standard cryptographic signing for your tokens.

Please let us know if you need any assistance setting up the KVM policy to retrieve your keys or if you have any questions!