8.14JWT mental model

JWT authentication looks conceptually like:

Mule
   ↓
private key signs JWT assertion
   ↓
Salesforce
   ↓
verifies signature
   ↓
issues OAuth token

Instead of sharing a client secret/password, you work with:

private key
public certificate

The private key must obviously be protected.

This pattern is common in enterprise integrations because it works well for automated server-to-server authentication.