Hi, Julius. Thank you for responding to my question.

I work for Department of Veterans Affairs. I believe the coding standard including prohibiting argumentless or exclusive NEW is not new.

Someone modified old code to become non-interactive. Unfortunately they did not follow coding standard and now it is up to me to fix it. I found where variables are killed.

I think a class method using procedure block should be equivalent to exclusive new. All variables are hidden except parameters or public list.

If images do not show in the above Article, please follow this link:

iris-http-calls/Setup_OAuth2_Client_for_Epic_on_FHIR.md at master · oliverwilms/iris-http-calls
 

I see there is a difference between base64 and base64url encoding ...

url - String based data encoding: Base64 vs Base64url - Stack Overflow
 

I added this line in my code:

Set jwt = $Translate(jwt,"+/=","-_")

I have updated flags to 1 to remove CR/LF.

I still see Invalid Signature warning in jwt.io

When I paste the jwt at https://jwt.io/, I see:

invalid signature

I have updated my code as follows:

ClassMethod test2() As %Status

{

    #Dim sigJOSE As %DynamicObject

    #Dim encJOSE As %DynamicObject

    #Dim claims As %DynamicObject

    Set ts = $ZTIMESTAMP  // 67161,81327.6633447

    Set exp = ##class(%OAuth2.Utils).TimeInSeconds(ts,300)

    Set nbf = ##class(%OAuth2.Utils).TimeInSeconds(ts,0)

    Set iat = ##class(%OAuth2.Utils).TimeInSeconds(ts,0)

    Set sigJOSE = {}

    Set sigJOSE.alg = "RS384"

    Set sigJOSE.typ = "JWT"

    Set header = sigJOSE.%ToJSON()

    Set claims = {}

    Set claims.iss = "863e73c5-9839-4b54-8205-c9404d2bb762"

    Set claims.sub = claims.iss

    Set claims.aud = "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token"

    Set claims.jti = "f9eaafba-2e49-11ea-8880-5ce0c5aee679"

    Set claims.exp = exp

    Set claims.nbf = nbf

    Set claims.iat = iat

    Set payload = claims.%ToJSON()

    //Set sigJWKS = ..MyKeys()

    //Set encJWKS = ""

    //Set tSC = ##class(%Net.JSON.JWT).Create(sigJOSE,{},claims,sigJWKS,encJWKS,.JWT)

    //Do $System.Status.DisplayError(tSC)

    Set bitLength = 384

    Set flags = 0

    Set tData = ##class(%SYSTEM.Encryption).Base64Encode(header,flags)_"."_##class(%SYSTEM.Encryption).Base64Encode(payload,flags)

    Set key = ..PrivateKey()

    //Set privKeyPassword = ""

    Set signature = ##class(%SYSTEM.Encryption).RSASHA3Sign(bitLength, tData, key)

    Set jwt = tData_"."_##class(%SYSTEM.Encryption).Base64Encode(signature,flags)

    Set pad = "="

    Set jwt = $Translate(jwt,pad,"")

    Set delim = $Char(13,10)

    For ii = 1:1:$Length(jwt,delim) {

        Write $Piece(jwt,delim,ii),!

    }

    Quit jwt

}

I had generated a signature in variable x. I forgot the next step:

The full JWT is constructed by combining the header, body and signature as follows:

base64urlEncoding(header) + '.' + base64urlEncoding(payload) + '.' + base64urlEncoding(signature)

That works. Thank you, Jeffrey