# How to use jwtfile enroll to connect to zac using browser

**URL:** <https://openziti.discourse.group/t/how-to-use-jwtfile-enroll-to-connect-to-zac-using-browser/1913>\
**Category:** BrowZer\
**Created:** [December 14, 2023, 8:46am UTC](https://openziti.discourse.group/t/how-to-use-jwtfile-enroll-to-connect-to-zac-using-browser/1913 "2023-12-14T08:46:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![McGonagall666](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\
**Post date:** [December 14, 2023, 8:46am UTC](https://openziti.discourse.group/t/how-to-use-jwtfile-enroll-to-connect-to-zac-using-browser/1913/1 "2023-12-14T08:46:49Z")

</div>

I have read a lot of documents and projects related to browZer, and after building the browZer project. BrowZer uses the idp verification method, while other client platforms use the jwtfile, I found that the verification methods are not quite the same. So I checked the code of the browZer dependency library , returned access in idp after the token is passed into the browzer-core library, authenticate?method=ext-jwt validated.  
Through this blog [Integrate OpenZiti with JWTs, PKIs for seamless service authentication](https://blog.openziti.io/openziti-authentication-api-integrations), and I was wondering if it's possible to use jwtfile to verify it, can I use jwtfile's token to replace the access\_token returned by idp. The idp verification process is completely different from the jwtfile+ott process. I would like to know where the key points of using a jwtfile are for BrowZer. The entire process of BrowZer seems to be for idp services, without jwtfile interface.  
If create a html and pass in a jwtfile, click enroll to connect to the zac or dark web, like other clients, and the serviceworker is responsible for fetch work in background

---

<div class="post-metadata">

**Author:** ![curt](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/curt/32/6_2.png) [@curt](https://openziti.discourse.group/u/curt)\
**Post date:** [December 14, 2023, 1:59pm UTC](https://openziti.discourse.group/t/how-to-use-jwtfile-enroll-to-connect-to-zac-using-browser/1913/2 "2023-12-14T13:59:48Z")

</div>

Hi @McGonagall666,

Yes, the Ziti BrowZer Runtime (ZBR) authenticates with the Ziti Control plane via a REST call to `authenticate?method=ext-jwt`. The Bearer token (i.e. the JWT) used on this REST call is dynamically obtained from whatever IdP is configured for the particular browZer stack. (_These IdP-based JWTs are ephemeral and tend to have a short lifespan, e.g. 8 hours, 24 hours, or similar, depending on how the system admin wishes to control it)._

The design of browZer involves no access to the client-side file system and no usage of the type of JWTs that are used in non-browZer enrollments and authentication flows.

It is not possible to do what you suggest.