Step 3D: Calculate the JWS Signature {#restgs-jwt-message-conf-token-sig}
=========================================================================

You can now calculate the JSON Web Signature (JWS). The JWS consists of the JWS header and claim set hashes in the following format. They are encrypted with the private key.  
`[JWS Header].[Claim Set]`  
Follow these steps to calculate the signature:

1. Concatenate the JWS header and claim set hash strings with a period character (`.`) between the hashes:  
   `[JWS Header].[Claim Set]` {#restgs-jwt-message-conf-token-sig_step1}
   {#restgs-jwt-message-conf-token-sig_step1}
2. Generate an encoded version of the text file using your private key from the *.p12* certificate. For more information, see [Create or Submit a P12 Certificate](/docs/vas/en-us/platform/developer/all/rest/rest-getting-started/restgs-jwt-message-intro/restgs-security-p12-intro.md ""). {#restgs-jwt-message-conf-token-sig_step2}
   {#restgs-jwt-message-conf-token-sig_step2}
3. Base64-encode the signature output. {#restgs-jwt-message-conf-token-sig_step3}
   {#restgs-jwt-message-conf-token-sig_step3}
4. After calculating the signature, you can construct a complete JWS token by combining the JWS header claims, body claims, and signature.{#restgs-jwt-message-conf-token-sig_step4}
   {#restgs-jwt-message-conf-token-sig_step4}

**Example: Token Signature Hash**

```
YjgwNGIxOTMxMzQ2NzhlYjdiMDdhMWZmYjZiYzUzNzliMTk5NzFmNjAzNWRmMThlNzk0N2NhY2U0YTEwNzYyYQ
```

**Code Example: Encoding the Signature File Using OpenSSL**  
Encode the signature file using the `openssl` tool.

```
openssl rsautl -encrypt -inkey publickey.key -pubin -in [signature-text-file]
					> [signature-encoded-file]
```

**Code Example: Base64 Encoding the Signature File Using the Command Line**  
Encode the signature file using the `openssl` tool and remove any padding.

```
base64 -i [signature-encoded-file]
```

**Result**
:
The result of this step is the encoded signature, which is the third segment of the JWS token. You have now created all three segments of the JWS token. The completed JWS token is the HTTP authorization header value.
:

    ```
    <Base64URL-encoded JWS Header>.<Base64URL-encoded JWS Body Claims>.<Base64URL-encoded Signature>
    ```

{#restgs-jwt-message-conf-token-sig_result}