**Creating a PoP Token with a DevEdge Library** We recommend using our libraries to help you create a PoP Token. We currently offer the following libraries to assist you: - [Java](/asset-download?filename=lib-tmobile-poptoken-builder-1.0.0.133.zip) ([Readme](/asset-download?filename=java-lib-tmobile-poptoken-builder-1.0.0-readme.pdf)) - [Javascript](/asset-download?filename=js-lib-tmobile-poptoken-builder-1.0.0.zip) ([Readme](/asset-download?filename=js-lib-tmobile-poptoken-builder-1.0.0-readme.pdf)) - [Python](/asset-download?filename=python-lib-tmobile-poptoken-builder-1.0.0.zip) ([Readme](/asset-download?filename=python-lib-tmobile-poptoken-builder-1.0.0-readme.pdf)) **Creating a PoP Token Manually** If you are coding in a language not provided in the DevEdge PoP Token Libraries, you will need to write your own code to build each PoP Token. Please see the official JWT documentation for instructions on how to create combine the header, payload and signature to create a PoP Token. We recommend using the official JWT libraries in your code base. **Header** ```json {"alg": "RS256","typ": "JWT"} ``` **Payload** ```json { "iat": "exp": "ehts": "edts": "jti": "v": } ``` **External Headers to Sign** The external headers to sign (`ehts`) field consists of semicolon separated names of headers and fields that will be hashed. The `http-method`, `uri` and `body` are predefined keywords for fields. We highly recommend to using `http-method` and `uri` for all requests. We also recommend including `body` whenever present. ```json { "http-method": , "uri": , "body": } ``` **External Data to Sign** Follow the steps below to create the external data (`edts`) to sign field: 1. Concatenate the values of headers and fields defined in `ehts`, with NO delimiter 2. Hash the concatenated string from step 1 using the sha256 algorithm 3. Base64 encode the hash from step 2 in a URL safe manner 4. Make the encoded string URL-safe: - Replace `+` with `-` - Replace `/` with `_` - Remove `=` characters **Signature** ```bash Signature: ``` ## Request ID and Access Tokens The ID Token and Access Token are returned in the response of the `/oauth2/v2/tokens` endpoint. Both the ID Token and Access Token are required to successfully authenticate every other DevEdge API request.

Coding APIs