diff --git a/.gitmodules b/.gitmodules
index a3b6450032a..03e4a541eec 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,6 +1,9 @@
 # Please do not use 'branch = ...' tags with submodule entries. Such tags make updating submodules a
 # little bit more convenient but they do *not* specify the tracked submodule branch. Thus, they are
 # more confusing than useful.
+[submodule "contrib/jwt-cpp"]
+	path = contrib/jwt-cpp
+	url = https://github.com/Thalhammer/jwt-cpp
 [submodule "contrib/zstd"]
 	path = contrib/zstd
 	url = https://github.com/facebook/zstd
diff --git a/contrib/CMakeLists.txt b/contrib/CMakeLists.txt
index fa0f95245f2..f9c57dc7fa1 100644
--- a/contrib/CMakeLists.txt
+++ b/contrib/CMakeLists.txt
@@ -217,7 +217,9 @@ add_contrib (libssh-cmake libssh)
 
 add_contrib (prometheus-protobufs-cmake prometheus-protobufs prometheus-protobufs-gogo)
 
-add_contrib(numactl-cmake numactl)
+add_contrib (numactl-cmake numactl)
+
+add_contrib (jwt-cpp-cmake jwt-cpp)
 
 # Put all targets defined here and in subdirectories under "contrib/<immediate-subdir>" folders in GUI-based IDEs.
 # Some of third-party projects may override CMAKE_FOLDER or FOLDER property of their targets, so they would not appear
diff --git a/contrib/jwt-cpp b/contrib/jwt-cpp
new file mode 160000
index 00000000000..a6927cb8140
--- /dev/null
+++ b/contrib/jwt-cpp
@@ -0,0 +1 @@
+Subproject commit a6927cb8140858c34e05d1a954626b9849fbcdfc
diff --git a/contrib/jwt-cpp-cmake/CMakeLists.txt b/contrib/jwt-cpp-cmake/CMakeLists.txt
new file mode 100644
index 00000000000..05400f1a954
--- /dev/null
+++ b/contrib/jwt-cpp-cmake/CMakeLists.txt
@@ -0,0 +1,18 @@
+option (ENABLE_JWT_CPP "Enable jwt-cpp library" ${ENABLE_LIBRARIES})
+
+if (NOT ENABLE_JWT_CPP)
+    message(STATUS "Not using jwt-cpp")
+    return()
+endif()
+
+if(ENABLE_JWT_CPP)
+    if(NOT TARGET OpenSSL::Crypto)
+        message (${RECONFIGURE_MESSAGE_LEVEL} "Can't use jwt-cpp without OpenSSL")
+    endif()
+endif()
+
+set (JWT_CPP_INCLUDE_DIR "${ClickHouse_SOURCE_DIR}/contrib/jwt-cpp/include")
+
+add_library (_jwt-cpp INTERFACE)
+target_include_directories(_jwt-cpp SYSTEM BEFORE INTERFACE ${JWT_CPP_INCLUDE_DIR})
+add_library(ch_contrib::jwt-cpp ALIAS _jwt-cpp)