IBM Sterling


This portal is to open public enhancement requests for IBM Sterling products and services. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Under review
Workspace Sterling B2B Integration SaaS
Categories API Gateway
Created by Guest
Created on Jul 11, 2026

RELATED IDEAS

Support for Custom JWT Authentication in IBM Sterling B2Bi SaaS API Gateway

Modern REST APIs increasingly use custom JWT (JSON Web Token) authentication flows where a dedicated authentication endpoint issues a time-limited Bearer token, which must then be dynamically injected into subsequent API calls. This pattern is used by major logistics, ERP, and SaaS vendors including DHL, FedEx, UPS, SAP BTP, Salesforce, and Microsoft Azure. IBM Sterling B2Bi SaaS API Gateway currently supports Username/Password (Basic Auth), Static Bearer Token, OAuth 2.0, and API Key — but none of these natively handle the custom JWT pattern where credentials are posted as a JSON body and a raw token string is returned with a short expiry window (typically 30 minutes). This forces customers into manual token refresh or custom middleware workarounds, creating operational risk and integration gaps.

Who would benefit:

  • IBM Sterling B2Bi SaaS customers integrating with modern REST APIs in logistics, supply chain, e-commerce, and manufacturing

  • Trading partner onboarding teams managing multiple REST API connections

  • Enterprise integration architects replacing legacy EDI connections with REST-based APIs

  • Any IBM Sterling customer whose trading partner uses JWT-based authentication — this number is growing rapidly as vendors migrate from SOAP/EDI to REST

How should it work:
The API Gateway should include a new authentication type called "Custom JWT" with the following configurable fields:

  1. Token endpoint URL (e.g. https://external.dhl.es/cimapi/api/v1/customer/authenticate)

  2. Token request method (POST)

  3. Token request body — configurable JSON key-value pairs (e.g. {"Username":"xxx","Password":"xxx"})

  4. Token response field — field name or raw string indicator

  5. Token expiry/refresh interval — configurable in minutes

  6. Authorization header format (e.g. Bearer <token>)

The gateway should automatically call the token endpoint before each API call or when the token is about to expire, extract the token, and inject it into the Authorization header of the target API call — without any manual intervention.

What is your industry? Travel & Transportation
How will this idea be used?

As an IBM Sterling B2Bi SaaS customer integrating with DHL Spain's CIMAPI REST API, I need to:

  1. Automatically POST credentials as a JSON body to DHL's authentication endpoint every 30 minutes to receive a fresh JWT token

  2. Extract the raw JWT string from the response

  3. Inject the token as a Bearer Authorization header into a scheduled GET call to DHL's tracking events endpoint

  4. Receive and process the JSON tracking events response for downstream EDI/business processing

With native Custom JWT support in IBM Sterling B2Bi SaaS API Gateway, this entire flow would be fully automated, scheduled, and maintainable through configuration alone — consistent with how OAuth 2.0 is handled today.
  • Admin
    Manoj Panda
    Jul 22, 2026

    Hi Vikram,

    Thank you for this exceptionally well-documented idea — the level of specificity you have provided, including the exact DHL CIMAPI flow, token lifecycle, and competitive context, makes this one of the most actionable submissions we have received on this topic.

    You have described a real and growing gap. The IBM Sterling B2Bi SaaS API Gateway today supports Username/Password (Basic Auth), Static Bearer Token, OAuth 2.0, and API Key authentication. What it does not natively handle is the custom JWT pattern where:

    • Credentials are submitted as a JSON body (not a standard OAuth grant)
    • The response is a raw token string (not an OAuth-compliant JSON envelope)
    • The token has a short, fixed expiry (e.g. 30 minutes) requiring automatic refresh

    This forces customers into manual token rotation or custom middleware — neither of which is acceptable for a 24/7 production integration. The DHL Spain CIMAPI case you have described is a concrete, high-urgency example, and we anticipate this pattern will recur with increasing frequency as more trading partners migrate from EDI/SOAP to REST.

    Your proposed design — a dedicated Custom JWT authentication type with configurable token endpoint, request body, response field extraction, expiry interval, and automatic pre-call refresh — is well-conceived and aligns closely with how we would approach this technically. The parallels with OAuth 2.0 handling in the gateway are the right reference point.

    Given the urgency and the direct business impact on the RS Components / DHL Spain integration, I am escalating this for prioritisation in our near-term roadmap review. A few questions to help us move quickly:

    1. Has IBM Engineering provided a formal workaround or interim guidance for the DHL CIMAPI case? If so, what is the current state of that integration?
    2. Beyond DHL Spain, are there other trading partners in your environment — or known to peers — using this same custom JWT pattern that would immediately benefit?
    3. Is there flexibility on the token response format, or is the raw string response (as opposed to a JSON wrapper like {"token": "..."}) the specific blocker?

    Your competitive benchmarking (MuleSoft, Boomi, Azure Integration Services) is noted — it reinforces the urgency of closing this gap. I will keep you informed as this progresses through our review.

    Best regards,
    Manoj Panda
    Product Manager, Sterling B2B Integration SaaS
    IBM

    Reply

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.