OAuth with a private JWK

Authenticate to Okta with a private JWK held in a file on the MIM server.

The management agent signs its OAuth client assertions with a private JWK read from a file on the MIM server. Okta holds only the matching public JWK.

If you need the private key to be non-exportable or held in hardware, use an X.509 certificate instead.

Step 1: Get a key pair

The easiest option is to let Okta generate one for you. Go to Creating the OAuth service app, choose Generate new key at the key step, and save the private JWK when Okta shows it. Okta generates a 2048-bit RSA pair and displays the private key exactly once.

Bring your own key pair instead if you need an EC key, a larger RSA key, or you have an existing key-generation process. Register only the public JWK in Okta.

Either way, the private JWK must meet the following requirements:

Key type	Algorithm
RSA, 2048 bits or larger	RS256, RS384, or RS512
EC P-256	ES256
EC P-384	ES384
EC P-521	ES512

The file must contain a single JWK object, not a JWKS document with a keys array, and that object must have:

• The private key values, so it can sign

• A non-empty kid matching the public JWK in Okta

• A supported alg

• "use": "sig", if use is present at all

• sign among its key_ops, if key_ops is present at all

Step 2: Put the key on the MIM server

Save the private JWK as UTF-8 JSON at a stable, fully qualified path. For example:

C:\ProgramData\Lithnet\Okta Management Agent\oauth-private.jwk.json

Grant the MIM Synchronization Service account read access to the file, and nothing more. The file must be under 65,536 bytes, although a single JWK won't come anywhere near that limit.

If you haven't created the Okta app yet, work through Creating the OAuth service app now, and come back here once the app has its public key, scopes, and admin role.

Step 3: Configure MIM

On the management agent Connectivity page:

1. Set Authentication method to OAuth 2.0 (private JWK).

2. Enter the app's client ID in OAuth client ID.

3. Enter the full path to the private JWK in Private JWK file path.

4. Enter your Okta org URL in Tenant URL, for example https://example.okta.com. Don't use the -admin hostname.

5. Set the log file path and log level.

6. Save the page.

Connectivity settings for private-JWK authentication.

The field takes a path, not the key itself. Do not paste the JWK JSON into it.

The Connectivity page shows the fields for all three authentication methods at once. With this method selected, only OAuth client ID, Private JWK file path, and Tenant URL are used. Leave API key and Certificate thumbprint empty.

Step 4: Retrieve the schema

Retrieve the management agent schema. The object types and attribute directions MIM shows should match the scopes granted to the service app.

If it fails, see private JWK troubleshooting.

Then continue with Creating the management agent.

Replacing the key

See Key and certificate rotation.