Authenticate with Private Key JWT using Amazon Bedrock AgentCore Identity | Artificial Intelligence

Amazon Bedrock AgentCore Identity now supports Private Key JWT client authentication for agents. With Private Key JWT client authentication, your agents can authenticate to a downstream identity provider’s token endpoint using a signed JSON Web Token (JWT) client assertion instead of a shared OAuth 2.0 client secret. You can register a public key with your identity provider, while the corresponding private key stays in an AWS Key Management Service (AWS KMS). To authenticate, AgentCore Identity uses AWS KMS to sign the assertion and sends the signed assertion to the identity provider, which verifies it using the public key you registered.

This post explains how Private Key JWT client authentication works in AgentCore Identity and reviews the supported grant flows. We then walk through creating an AWS KMS signing key, registering its public key with your identity provider, configuring a credential provider on the AWS Management Console, and reviewing example AWS CloudTrail events that record your agent’s access.

The following example illustrates the request flow. Consider a customer-support agent that needs to read a customer’s order history from an internal orders API protected by your identity provider.

Figure 1 – Example request flow for a machine-to-machine token request, from the agent’s call through to the downstream API

The following diagram illustrates the request flow:

Overview of supported grant flows

Private Key JWT authentication works for the three grant flows:

This post assumes that you have

The following sections show how to configure Private Key JWT as the client authentication method using the AWS Management Console.

Start by creating an asymmetric KMS key that AgentCore Identity will use to sign the JWT client assertion. In this example, we create the key in KMS and export the corresponding public key to the Identity provider. However, if your identity provider generates the key pair and gives you the private key material instead, you can import it to KMS.

Figure 2 – Adding an OAuth client from the AgentCore Identity console

On the Add OAuth Client page, in the Provider configurations section:

Figure 3 – Selecting Private key JWT as the client authentication method

Note: You can also use a key from another account in the same Region by entering that key’s ARN. Cross-account access requires extra permissions in both accounts. See Allowing users in other accounts to use a KMS key.

Figure 4 – Providing the discovery URL, client ID, asymmetric KMS key and signing algorithm

If your identity provider requires additional claims in the JWT client assertion, add them here:

Figure 5 – Adding optional header and payload claims before creating the client

Example CloudTrail logs for the agent access

When an agent uses the credential provider to fetch a token, the operations are recorded on AWS CloudTrail so you can audit each access. You will see event names such as:

To avoid incurring ongoing charges and to remove resources you no longer need, clean up the credential provider and the KMS signing key you created in this walkthrough.

Deleting a KMS key is irreversible and permanent. Once the key is deleted, any data or signatures that depend on it can no longer be produced, so KMS requires you to schedule deletion with a waiting period rather than deleting immediately. Before you schedule deletion, confirm the key is no longer referenced by any credential provider or identity provider registration. If you are unsure whether the key is still in use, consider disabling the key instead, which stops it from being used while keeping it recoverable.

After the waiting period elapses, KMS permanently deletes the key. Remember to also remove or rotate the corresponding public key you registered with your identity provider, so it no longer trusts the retired key.

By using Private Key JWT client authentication in AgentCore Identity, you can give your agents a secret-less, auditable way to authenticate to identity providers. The signing key stays on AWS KMS, every signing operation is recorded on AWS CloudTrail, and the same credential provider extends across M2M, on-behalf-of, and user-delegated flows. For end-to-end samples, including Entra and Okta identity-provider registration and both M2M and OBO flows, see the Amazon Bedrock AgentCore samples on GitHub.