Welcome to the RingCentral Community

RingCentral API documentation is the worst documentation by a major company that I have ever encountered. So many circular references and ambiguous language, it is so frustrating to try to figure out how this shit works! Can't RC hire a competent documentation writer?

For example, this is a direct quote from a documentation page: "The key to groking how RingCentral uses JWTs is in understanding that JWTs are not used directly to call the API."

WTF is "groking"?

We are trying to figure out this JWT Authentication workflow, which, to restate my frustration, makes no sense. Documentation states that the JWT has to be created by a user, but only users who have access to the Dev Console can create JWT. How, then, are we supposed to create JWT for the other users? In the Password Flow, we have to provide username and password to authenticate the user and obtain a token for that user, but in JWT there is no way to identify which user is requesting the token. I cannot find any information about how this is handled.

Thanks @Phong Vu. Are you able to check my ClientID and Client Secret from your end? I have followed your tutorial but even in php or using curl in terminal I am getting AGW-402 Invalid Authorization

What you tried was incorrect. The JWT token is not an access token, but it is a user credential that you can use to get the access token and refresh token instead of using the user username and password. If you understand PHP, you can convert this function to VBA script for your app.

private function authenticate(){
      $url = $_ENV["RC_SERVER_URL"] . "/restapi/oauth/token";
      $basic = $_ENV["RC_CLIENT_ID"] .":". $_ENV["RC_CLIENT_SECRET"];
      $headers = array (
              'Content-Type: application/x-www-form-urlencoded; charset=UTF-8',
              'Accept: application/json',
              'Authorization: Basic '.base64_encode($basic)
            );
      $body = http_build_query(array (
              'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',
              'assertion' => $_ENV["JWT_TOKEN"]
            ));
      try {
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($ch, CURLOPT_POST, TRUE);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($ch, CURLOPT_TIMEOUT, 600);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $body);

        $strResponse = curl_exec($ch);
        $curlErrno = curl_errno($ch);
        if ($curlErrno) {
          throw new Exception($curlErrno);
        } else {
          $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
          curl_close($ch);
          if ($httpCode == 200) {
            $date = new DateTime();
            $jsonObj = json_decode($strResponse);
            $tokensObj = array(
              "tokens" => $jsonObj,
              "timestamp" => $date->getTimestamp()
            );
            // Logged in successfully => Save tokens in session or write to file/database for reuse
            $_SESSION['sessionAccessToken'] =  json_encode($tokensObj, JSON_PRETTY_PRINT);
            return;
          }else{
            throw new Exception($strResponse);
          }
        }
      } catch (Exception $e) {
        throw $e;
      }
    }

You can get the entire PHP project from my GitHub repo to learn more about how to use the refresh token to get a new access token if it expires.