# Looking to sign the JWT with ECDSA (ES256) on Google Apps Script

**URL:** <https://community.auth0.com/t/looking-to-sign-the-jwt-with-ecdsa-es256-on-google-apps-script/37171>\
**Category:** JWT.io\
**Created:** [January 31, 2020, 2:56pm UTC](https://community.auth0.com/t/looking-to-sign-the-jwt-with-ecdsa-es256-on-google-apps-script/37171 "2020-01-31T14:56:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dimitri.leroux](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dimitri.leroux/32/18832_2.png) [@dimitri.leroux](https://community.auth0.com/u/dimitri.leroux)\
**Post date:** [January 31, 2020, 2:56pm UTC](https://community.auth0.com/t/looking-to-sign-the-jwt-with-ecdsa-es256-on-google-apps-script/37171/1 "2020-01-31T14:56:16Z")

</div>

Hi there! Thanks for this great threads of questions/answers.

Not sure if that’s possible, but I’m getting stuck on GAS with ECDSA signature because there is no native library… I’m using HMAC but Token remains false.

```
var header = {
"alg": "ES256",
"kid": "private",
"typ": "JWT"
};

var encodedHeader = Utilities.base64EncodeWebSafe(JSON.stringify(header));
      
var data = {
"iss": "private",
"exp": 1580425545,
"aud": "appstoreconnect-v1"
};

var encodedData = Utilities.base64EncodeWebSafe(JSON.stringify(data));
                           
var token = encodedHeader + "." + encodedData;

var secret = "private key"

var signature = Utilities.computeHmacSha256Signature(token, secret);
  
signature = Utilities.base64EncodeWebSafe(signature);
  
var signedToken = token + "." + signature;

```

Thanks!

---

<div class="post-metadata">

**Author:** ![rashid779939](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rashid779939/32/27027_2.png) [@rashid779939](https://community.auth0.com/u/rashid779939)\
**Post date:** [February 6, 2020, 5:33am UTC](https://community.auth0.com/t/looking-to-sign-the-jwt-with-ecdsa-es256-on-google-apps-script/37171/2 "2020-02-06T05:33:52Z")

</div>

I think Auth0 support only HS256 and RS256 encription only.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 6, 2020, 11:03am UTC](https://community.auth0.com/t/looking-to-sign-the-jwt-with-ecdsa-es256-on-google-apps-script/37171/3 "2020-02-06T11:03:37Z")

</div>

Yes, that is correct!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 21, 2020, 11:03am UTC](https://community.auth0.com/t/looking-to-sign-the-jwt-with-ecdsa-es256-on-google-apps-script/37171/4 "2020-02-21T11:03:38Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.