Can I create a JWT credential via an API?

I keep coming back to this question when thinking of my application’s use case. I feel I need to user user JWTs but I also need server side, impersonating user initiated actions. 

Think of a scenario where I have recruiter type users. They use RingCentral’s features such that they can call and text applicants from within our app. But as well, when they are not logged in, we want our app to send notifications to talent (SMS) on behalf of the recruiter. Say a reminder to upload a document, etc. But we want this SMS to come FROM the recruiter so there is a continuous message history. Not some central system use number.

I can solve this with User JWTs but that requires my user to login to a RIngCentral account we provision for them and create a JWT to supply to us (or manually have a super admin add them as a developer, create it for them, and upload the user JWT to our secure key vault). Not an ideal scenario.

Am I over thinking this? Is there a better way to manage this type of long lived, impersonated type of user authentication?

​@ameyer Thank you so much for asking this question. JWT is an attractive option for many because it is so much easier to use, and especially get started with. But JWT doesn’t scale. It is hard to generate JWT credentials for all users. I know this sounds counterintuitive, but to be honest, that is partially by design. 

JWTs are powerful. They give the bearer direct access to the account and bypass two-factor auth. They should be used sparingly, and with great care. 

Auth token based OAuth is much more secure, and it provides a level of transparency to the user as to what can be done with their authorization. When it comes to granting systems the authority to act on their behalf, we feel this is very important. 

Your use case really does call for the use of the auth token grant type or flow. 

But here is one thing you may not have known:

• Developer Admins do have the ability to generate JWT on behalf of someone else

I am not here to tell you that you “shouldn’t use JWT.” Just to advise you. There are ways to make it work of course, but I am not personally a fan of the overhead required to do so. 

You should consider looking into Workflow Builder. It offers admins the ability to automate SMS responses and messages on behalf of other users in their company. That might also have been a solution you may have overlooked.