Private key JWT

Set up Okta app authentication using private key JWT for autonomous MCP clients.

About this task

Early Access release

Use this method for autonomous agents and backend services that run without human intervention, such as CI/CD pipelines or automated workflows.

  • Create an API service app integration
    1. In the Admin Console, go to Applications and resources > Applications.
    2. Click Create App Integration.
    3. Select API Services as the Sign-in method.
    4. Click Next.
    5. Enter an App integration name, such as "Okta Managed MCP Server automation".
    6. Click Save.
  • Configure client authentication
    1. In the Client Credentials section, click Edit.
    2. Select Public key / Private key.
    3. In the Public keys section, click Edit.
    4. In Public keys > Configuration, select Save keys in Okta.
    5. Click Add key.
    6. In the Public Keys section, click Add Key. The Add a public key dialog opens.

  • Generate or add a public key

    You can either generate the key in Okta (recommended) and copy it in PEM format, or upload your own keys.

    1. Generate a key in Okta:
      1. In the Public Keys section, click Add key.
      2. In the dialog, select Generate new key.
      3. Select the PEM format and click Copy to clipboard.
      4. Click Done.
      5. In Client Credentials, copy the Client ID.
      6. In Public keys, copy the Key ID (KID) displayed.
      7. Click Save.
      8. In General Settings, click Edit.
      9. Disable Require Demonstrating Proof of Possession (DPoP) header in token requests.
      10. Click Save.
    2. Upload your own key:
      1. Generate a 2048-bit RSA private key locally: 
        openssl genpkey -algorithm RSA -out private.pem -pkeyopt rsa_keygen_bits:2048
      2. Extract the public key from the private key: 
        openssl rsa -in private.pem -pubout -out public.pem
      3. In the Public Keys section, click Add key and paste the contents of your public key (public.pem) into the dialog.
      4. Click Save.
      5. Copy the Key ID (KID) displayed for the added key.
  • Okta API scopes and admin role
    1. Go to the Okta API Scopes tab and grant the required API scopes.

      The scopes you grant here determine which tools load for this app. See Scope-based tool loading.

    2. Go to the Admin roles tab, and click Edit assignments.
    3. Select an admin role (see Learn about administrators) and click Save changes.
    4. Go to the General tab and copy the Client ID.

    You've created an app integration, configured the authentication flow, and granted the required API scopes for your Okta Managed MCP Server.

    Authenticate with the Okta Managed MCP Server

    Your autonomous agent uses the private key to generate a token by calling the Okta token endpoint:

    https://<your-okta-org>.okta.com/oauth2/v1/token

    The agent exchanges the private key for a short-lived access token and uses that token to communicate with the Okta Managed MCP Server. No user interaction is required. However, you need to ensure that the autonomous agent is compatible with the MCP.