# November 2, 2026 - Certificate access tokens are always returned as JWE

**URL:** <https://community.cumulocity.com/t/november-2-2026-certificate-access-tokens-are-always-returned-as-jwe/15334>\
**Category:** Platform services\
**Tags:** Api-change, authentication, platform-services\
**Created:** [November 3, 2026, 7:07am UTC](https://community.cumulocity.com/t/november-2-2026-certificate-access-tokens-are-always-returned-as-jwe/15334 "2026-11-03T07:07:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![cumulocity](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/cumulocity/32/31990_2.png) [@cumulocity](https://community.cumulocity.com/u/cumulocity)\
**Post date:** [November 3, 2026, 7:07am UTC](https://community.cumulocity.com/t/november-2-2026-certificate-access-tokens-are-always-returned-as-jwe/15334/1 "2026-11-03T07:07:02Z")

</div>

## Context

* * *

**Change Type:** API change  
**Product area:** Platform services  
**Component:** Authentication  
**Deployed at:**

> **Technical details**
>
> **Build artifact:** cumulocity (2026.405.0)  
> **Internal ID:** MTM-68156

## Description

* * *

The `POST /tenant/oauth/certificate` endpoint now always returns the access token as a JWE encrypted with the public key from the presented certificate. The `X-Cumulocity-Token-Response-Mode` header is no longer supported and the `response_mode` field has been removed from the response. For details, see [Retrieving a platform token using an X.509 certificate](https://cumulocity.com/docs/authentication/oai-secure/#retrieving-a-platform-token-using-an-x509-certificate).