diff --git a/esp32_device/.vscode/settings.json b/esp32_device/.vscode/settings.json
index 2669f47..1111ea0 100644
--- a/esp32_device/.vscode/settings.json
+++ b/esp32_device/.vscode/settings.json
@@ -47,6 +47,8 @@
     "format": "c",
     "span": "c",
     "regex": "c",
-    "stdlib.h": "c"
+    "stdlib.h": "c",
+    "secure_api.h": "c",
+    "jwt.h": "c"
   }
 }
diff --git a/esp32_device/main/crypto.c b/esp32_device/main/crypto.c
index 6561ff7..4dbd65e 100644
--- a/esp32_device/main/crypto.c
+++ b/esp32_device/main/crypto.c
@@ -13,6 +13,7 @@
 #include <mbedtls/sha256.h>
 #include <mbedtls/pk.h>
 #include <mbedtls/x509_csr.h>
+#include <mbedtls/base64.h>
 #include "esp_log.h"
 
 #define ECPARAMS MBEDTLS_ECP_DP_SECP256R1
@@ -189,4 +190,38 @@ char *crypto_get_csr()
     mbedtls_entropy_free(&entropy);
 
     return csr;
+}
+
+char *crypto_encode_base64_safe_url(const char *src, size_t srclen)
+{
+    size_t olen = 0;
+    mbedtls_base64_encode(NULL, 0, &olen, (unsigned char *)src, srclen);
+
+    if (olen < 1)
+    {
+        ESP_LOGE(TAG, "Failed to determine base64 buffer size!");
+        return NULL;
+    }
+
+    char *out = calloc(1, olen);
+    if (!out)
+    {
+        ESP_LOGE(TAG, "Failed to allocate memory for destination buffer!");
+        return NULL;
+    }
+
+    if (mbedtls_base64_encode((unsigned char *)out, olen, &olen, (unsigned char *)src, srclen) != 0)
+    {
+        ESP_LOGE(TAG, "Failed to perfom base64 encoding!");
+        free(out);
+        return NULL;
+    }
+
+    if (out[olen - 1] == '=')
+        out[olen - 1] = '\0';
+
+    if (out[olen - 2] == '=')
+        out[olen - 2] = '\0';
+
+    return out;
 }
\ No newline at end of file
diff --git a/esp32_device/main/crypto.h b/esp32_device/main/crypto.h
index ebeab06..ca586bc 100644
--- a/esp32_device/main/crypto.h
+++ b/esp32_device/main/crypto.h
@@ -5,6 +5,7 @@
 #pragma once
 
 #include <stdbool.h>
+#include <stddef.h>
 
 #ifdef __cplusplus
 extern "C"
@@ -31,6 +32,13 @@ extern "C"
      */
     char *crypto_get_csr();
 
+    /**
+     * Encode buffer to base64 safe URL string
+     *
+     * @return A buffer that needs to be freed or NULL in case of failure
+     */
+    char *crypto_encode_base64_safe_url(const char *src, size_t srclen);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/esp32_device/main/jwt.c b/esp32_device/main/jwt.c
index 756971b..d2e8103 100644
--- a/esp32_device/main/jwt.c
+++ b/esp32_device/main/jwt.c
@@ -4,6 +4,7 @@
 
 #include "jwt.h"
 #include "dev_name.h"
+#include "crypto.h"
 
 #include "esp_log.h"
 
@@ -34,7 +35,19 @@ char *jwt_gen(cJSON *payload)
         return NULL;
     }
 
-    printf("header: %s\n", header);
+    char *header_b64 = crypto_encode_base64_safe_url(header, strlen(header));
+    free(header);
 
+    if (!header_b64)
+    {
+        ESP_LOGE(TAG, "Failed to encode header to base64!");
+        return NULL;
+    }
+
+    printf("header = %s\n", header_b64);
+
+    free(header_b64);
+
+    // TODO : continue
     return strdup("TODO:)");
 }
\ No newline at end of file
diff --git a/esp32_device/main/main.c b/esp32_device/main/main.c
index a491b8c..9caf544 100755
--- a/esp32_device/main/main.c
+++ b/esp32_device/main/main.c
@@ -167,6 +167,7 @@ void app_main(void)
     // Main loop
     ESP_LOGI(TAG, "Starting main loop");
 
+    // TODO : implement more properly
     while (true)
     {
         if (!secure_api_sync_device())
diff --git a/esp32_device/main/secure_api.c b/esp32_device/main/secure_api.c
index 5f1e0a7..323a3e8 100644
--- a/esp32_device/main/secure_api.c
+++ b/esp32_device/main/secure_api.c
@@ -218,6 +218,7 @@ void *secure_api_sync_device()
     printf("JWT: %s\n", encoded_req);
     free(encoded_req);
 
+    // TODO : replace
     printf("here implement sync device logic\n");
     return NULL;
 }
\ No newline at end of file