Authenticate with Private Key JWT using Amazon Bedrock AgentCore Identity

<p><a href="https://aws.amazon.com/bedrock/agentcore/" target="_blank" rel="noopener">Amazon Bedrock AgentCore Identity</a> now supports Private Key JWT client authentication for agents. With Private Key JWT client authentication, your agents can authenticate to a downstream identity provider’s token endpoint using a signed JSON Web Token (JWT) client assertion instead of a shared OAuth 2.0 client secret. You can register a public key with your identity provider, while the corresponding private key stays in an <a href="https://aws.amazon.com/kms/" target="_blank" rel="noopener">AWS Key Management Service</a> (AWS KMS). To authenticate, <a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity.html" target="_blank" rel="noopener">AgentCore Identity</a> uses AWS KMS to sign the assertion and sends the signed assertion to the identity provider, which verifies it using the public key you registered.</p> <p>This post explains how Private Key JWT client authentication works in AgentCore Identity and reviews the supported grant flows. We then walk through creating an AWS KMS signing key, registering its public key with your identity provider, configuring a credential provider on the AWS Management Console, and reviewing example AWS CloudTrail events that record your agent’s access.</p> <h2 id="how-does-it-work">How does it work?</h2> <p>The following example illustrates the request flow. Consider a customer-support agent that needs to read a customer’s order history from an internal orders API protected by your identity provider.</p> <p><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/07/28/ML-21480-1.png" alt="Request flow showing the agent calling AgentCore Identity, which signs a JWT with KMS, posts the assertion to the identity provider, and returns an access token to the agent" width="800"></p> <p><em>Figure 1 – Example request flow for a machine-to-machine token request, from the agent’s call through to the downstream API</em></p> <p>The following diagram illustrates the request flow:</p> <ol type="1"> <li>The agent calls <code>GetResourceOauth2Token</code> on AgentCore Identity to request a token for the orders API.</li> <li>AgentCore Identity reads the client ID, KMS key ARN, and signing algorithm from your credential provider. It builds a short-lived JWT client assertion with the required payload claims (plus any additional header or payload claims you configured, such as a key identifier or a certificate thumbprint), and calls <code>kms:Sign</code> against your KMS asymmetric signing key using the signing algorithm you configured (RS256, PS256, or ES256).</li> <li>AWS KMS signs the assertion and returns the signature to AgentCore Identity. The private key never leaves KMS.</li> <li>AgentCore Identity posts the signed assertion to your identity provider’s token endpoint with <code>grant_type=client_credentials</code> and <code>client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer</code>.</li> <li>The identity provider verifies the signature against the public key you registered and returns an access token to AgentCore Identity.</li> <li>AgentCore Identity returns the access token to your agent.</li> <li>The agent calls the orders API with the access token.</li> <li>The orders API returns the customer’s order history.</li> </ol> <h2 id="overview-of-supported-grant-flows">Overview of supported grant flows</h2> <p>Private Key JWT authentication works for the three grant flows:</p> <ul> <li><strong>Machine-to-machine (M2M)</strong>: the agent acts as itself. There is no human user in the picture. The agent needs to access a resource, for example a background job syncing data, or a service that any customer-support agent can read regardless of who triggered it. The token represents the application/agent identity. Uses the client_credentials grant. The token’s subject is the client itself.</li> <li><strong>On-be