From 1639ed2d7ab560ca8b5d6a617b8968c59906343f Mon Sep 17 00:00:00 2001
From: hisanhunais <hisan.live@gmail.com>
Date: Wed, 19 Aug 2026 10:21:57 +0530
Subject: [PATCH] Fix incorrect cnf/x5t#S256 example in Certificate Bound
 Access Tokens doc

---
 ...securing-apis-using-certificate-bound-access-tokens.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/en/docs/api-security/runtime/api-authentication/securing-apis-using-certificate-bound-access-tokens.md b/en/docs/api-security/runtime/api-authentication/securing-apis-using-certificate-bound-access-tokens.md
index bb46a63b51..d8e021272f 100644
--- a/en/docs/api-security/runtime/api-authentication/securing-apis-using-certificate-bound-access-tokens.md
+++ b/en/docs/api-security/runtime/api-authentication/securing-apis-using-certificate-bound-access-tokens.md
@@ -92,9 +92,13 @@ Import the certificate and private key to Postman.
    
      The token comprises of client certificate thumbprint as the cnf claim.
    
+    ```json
+    "cnf": {
+      "x5t#S256": "mgw1cKxzkr7hSkCOyziXiFKobTjLwIf-7uqrLJoHufE"
+    }
     ```
-    "cnf", "{"x5t#S256": "9a0c3570ac7392bee14a408ecb38978852a86d38cbc087feeeeaab2c9a07b9f1"}"
-    ```
+
+     The `x5t#S256` value is the base64url-encoded SHA-256 thumbprint of the DER-encoded client certificate, as defined in [RFC 8705](https://www.rfc-editor.org/rfc/rfc8705#name-jwt-certificate-thumbprint-).
 
 4. Invoke the API from Postman.