# B2c and JWT for authentication **URL:** \ **Category:** Ask the community\ **Tags:** web-request\ **Created:** [February 24, 2025, 7:19am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670 "2025-02-24T07:19:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![haider.ahmad](https://avatars.discourse-cdn.com/v4/letter/h/2bfe46/32.png) [@haider.ahmad](https://community.appfarm.io/u/haider.ahmad)\ **Post date:** [February 24, 2025, 7:19am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/1 "2025-02-24T07:19:52Z")
Hello Community! I’m wondering if there is a way to use B2C to authenticate someone and save the JWT payload it sends to further authenticate towards a database. In this case i’m wondering if there is a way to decrypt the jwt or does that have to be done maunally. Also if i have multiple apis and i want the user secret and pass secret to change based on the user when calling the database. Is this possible? Regards Haider ---
**Author:** ![kristian](https://dub1.discourse-cdn.com/flex013/user_avatar/community.appfarm.io/kristian/32/58_2.png) [@kristian](https://community.appfarm.io/u/kristian)\ **Post date:** [February 24, 2025, 10:00am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/2 "2025-02-24T10:00:20Z")
Hi! Yes, it is. B2C to be used for authentication is pretty straight forward, and with a few more settings, you can also save the access token (received in the signed JWT together with email, user name and other claims) **First** : Add B2C as Custom Auth Provider if not already done. > **[Implement third-party authentication | Appfarm Documentation](https://docs.appfarm.io/how-to/authentication-and-access-control/third-party-authentication#authentication-using-azure-a-d-b2c)** **Then:** The login should send a signed JWT back containing an Access Token. So, you need somewhere to save that. Appfarm comes with this feature built-in when you add a Secret. As described [here](https://docs.appfarm.io/reference/security/secrets#properties), you should add a Secret with Secret Type `OAuth 2 Value`, and and OAuth value set to `Access Token` (if it’s not working, try ID Token instead). The new secret should look like this: ![image](https://europe1.discourse-cdn.com/flex013/uploads/appfarm/original/2X/2/2d1ce86708609a5969ea5572fd4488a7e4f26618.png) With this setup, the value of this secret should be stored “per user”, and when e.g. a user triggers a web request (towards) using this secret as authentication, the access token of that user will be used. ---
**Author:** ![haider.ahmad](https://avatars.discourse-cdn.com/v4/letter/h/2bfe46/32.png) [@haider.ahmad](https://community.appfarm.io/u/haider.ahmad)\ **Post date:** [February 24, 2025, 10:41am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/3 "2025-02-24T10:41:12Z")
Thank you very much! I have already created the secret to store the claims, but where do i add that secret to get the claims is my question? maybe i’m asking a bit confusing here ---
**Author:** ![kristian](https://dub1.discourse-cdn.com/flex013/user_avatar/community.appfarm.io/kristian/32/58_2.png) [@kristian](https://community.appfarm.io/u/kristian)\ **Post date:** [February 24, 2025, 11:33am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/4 "2025-02-24T11:33:46Z")
Hi! Not sure if I misunderstood. But, if you have that Secret stored (similar to my previous screenshot) and User A logs in with B2C, the Secret `B2C Access Token` is set to automatically upon login. This secret can hold 1 value for each user, so if user B logs in the same time, value is different for user B. For authenticating towards some resource in Azure using the (personal) access token: Use the Web Request with “Bearer” authentication towards the resource that the user have access to, and select the secret `B2C Access Token` as Bearer Token. When User A executes the web request, then User A’s access token is used. And similar for User B. ---
**Author:** ![haider.ahmad](https://avatars.discourse-cdn.com/v4/letter/h/2bfe46/32.png) [@haider.ahmad](https://community.appfarm.io/u/haider.ahmad)\ **Post date:** [February 24, 2025, 11:37am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/5 "2025-02-24T11:37:05Z")
So if i understand correctly! it gets populated without being referenced anywhere? ---
**Author:** ![kristian](https://dub1.discourse-cdn.com/flex013/user_avatar/community.appfarm.io/kristian/32/58_2.png) [@kristian](https://community.appfarm.io/u/kristian)\ **Post date:** [February 24, 2025, 11:59am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/6 "2025-02-24T11:59:13Z")
Yes, that is correct! I have not set up B2C myself, but I know other have managed this. ---
**Author:** ![haider.ahmad](https://avatars.discourse-cdn.com/v4/letter/h/2bfe46/32.png) [@haider.ahmad](https://community.appfarm.io/u/haider.ahmad)\ **Post date:** [February 28, 2025, 10:41am UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/7 "2025-02-28T10:41:29Z")
Hello @kristian Is there a way we can expose the secret so we can see what we are getting in the jwt and test things out? I would like to see what i’m getting from the B2C. ---
**Author:** ![kristian](https://dub1.discourse-cdn.com/flex013/user_avatar/community.appfarm.io/kristian/32/58_2.png) [@kristian](https://community.appfarm.io/u/kristian)\ **Post date:** [February 28, 2025, 1:24pm UTC](https://community.appfarm.io/t/b2c-and-jwt-for-authentication/1670/8 "2025-02-28T13:24:50Z")
Hi, I believe you could do the following for debug this: 1. Create a Service “Debug token service” etc. Inside it, just have an action with “Log to console”, logging out the secret value 2. An App with a button etc with an action with action node `Run Service` running the Debug token service Then 1. Open Devtools for Services, locate the Debug token service, and click “Enable capture”. 2. Log in and open the App in another tab, and click the button. Now, since you are logged in as a user and performing a “Run Service” as yourself, the secret that is logged should be your access token.