Thanks for the comments. Think a new module auth_jwt is a better way. Will take a closer look at auth_ephemeral. The two IETF draft I was looking at are http://www.ietf.org/id/draft-ietf-oauth-json-web-token-32.txt <http://www.ietf.org/id/draft-ietf-oauth-json-web-token-32.txt> and http://www.ietf.org/id/draft-ietf-jose-json-web-signature-40.txt <http://www.ietf.org/id/draft-ietf-jose-json-web-signature-40.txt>. OAuth 2.0 is a nice framework to handle auth and issue web tokens. But maybe the first step is to use configured public keys to verify the token and then use info from the token to validate SIP messages. Another thing is that it seems we need a new SIP header to send the JWT token. Cannot find an existing header that is suitable for JWT. 

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br>Reply to this email directly or <a href="https://github.com/kamailio/kamailio/issues/29#issuecomment-69868305">view it on GitHub</a>.<img alt="" height="1" src="https://github.com/notifications/beacon/AF36ZTsbJbIIKwkUxW7dBQDbQ0XA1LJDks5nhepsgaJpZM4DRWgb.gif" width="1" /></p>
<div itemscope itemtype="http://schema.org/EmailMessage">
  <div itemprop="action" itemscope itemtype="http://schema.org/ViewAction">
    <link itemprop="url" href="https://github.com/kamailio/kamailio/issues/29#issuecomment-69868305"></link>
    <meta itemprop="name" content="View Issue"></meta>
  </div>
  <meta itemprop="description" content="View this Issue on GitHub"></meta>
</div>