OAuth 2.0 Webhook Auth

[Chris Hoogeboom]

The documentation for webhooks says that the webhook request will be secured with bearer auth

https://developer.atlassian.com/cloud/jira/platform/webhooks/#webhooks-authentication-for-oauth-2-0-apps

After I decode the token using my client secret, what should the body of the decoded token contain?

Edit for clarity: The payload of a JWT contains a number of "claims". These can be things like iss (issuer), exp (expiration time), sub (subject), aud (audience), and others. I'm wondering what claims will be included in the JWT that Jira passes to my webhook callback. For example, can I expect the expiration time to be included, so that I can verify the token hasn't expired?

[Mohanraj Thangamuthu]

Hello, Good day. I hope the following link helps your requirement. https://community.atlassian.com/forums/Jira-articles/Automation-for-Jira-Send-web-request-using-Jira-REST-API/ba-p/1443828

[Chris Hoogeboom]

Hey, thanks for the response! The article you linked me is related to sending web requests via automation rules. In that article, the example rule is using Basic auth and is encoding the token from the following pattern: <EMAIL>:<API_TOKEN>.

The document I linked above says that Webhooks use Bearer auth. Typically bearer tokens include encoded information, like the User ID and expiration time. My question is what is the schema of the decoded token?