Amazon Bedrock AgentCore Identification now helps Personal Key JWT shopper authentication for brokers. With Personal Key JWT shopper authentication, your brokers can authenticate to a downstream identification supplier\u2019s token endpoint utilizing a signed JSON Internet Token (JWT) shopper assertion as an alternative of a shared OAuth 2.0 shopper secret. You’ll be able to register a public key along with your identification supplier, whereas the corresponding personal key stays in an AWS Key Administration Service (AWS KMS). To authenticate, AgentCore Identification makes use of AWS KMS to signal the assertion and sends the signed assertion to the identification supplier, which verifies it utilizing the general public key you registered.<\/p>\n
This publish explains how Personal Key JWT shopper authentication works in AgentCore Identification and evaluations the supported grant flows. We then stroll via creating an AWS KMS signing key, registering its public key along with your identification supplier, configuring a credential supplier on the AWS Administration Console, and reviewing instance AWS CloudTrail occasions that file your agent\u2019s entry.<\/p>\n
How does it work?<\/h2>\n
The next instance illustrates the request movement. Contemplate a customer-support agent that should learn a buyer\u2019s order historical past from an inside orders API protected by your identification supplier.<\/p>\n
![\"Request](\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2026\/07\/28\/ML-21480-1.png\")
<\/p>\n
Determine 1 \u2013 Instance request movement for a machine-to-machine token request, from the agent\u2019s name via to the downstream API<\/p>\n
The next diagram illustrates the request movement:<\/p>\n
The agent calls GetResourceOauth2Token on AgentCore Identification to request a token for the orders API.
\n AgentCore Identification reads the shopper ID, KMS key ARN, and signing algorithm out of your credential supplier. It builds a short-lived JWT shopper assertion with the required payload claims (plus any extra header or payload claims you configured, reminiscent of a key identifier or a certificates thumbprint), and calls kms:Signal towards your KMS uneven signing key utilizing the signing algorithm you configured (RS256, PS256, or ES256).
\n AWS KMS indicators the assertion and returns the signature to AgentCore Identification. The personal key by no means leaves KMS.
\n AgentCore Identification posts the signed assertion to your identification supplier\u2019s token endpoint with grant_type=client_credentials and client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
\n The identification supplier verifies the signature towards the general public key you registered and returns an entry token to AgentCore Identification.
\n AgentCore Identification returns the entry token to your agent.
\n The agent calls the orders API with the entry token.
\n The orders API returns the client\u2019s order historical past.<\/p>\n
Overview of supported grant flows<\/h2>\n
Personal Key JWT authentication works for the three grant flows:<\/p>\n
Machine-to-machine (M2M): the agent acts as itself. There isn’t any human consumer within the image. The agent must entry a useful resource, for instance a background job syncing information, or a service that any customer-support agent can learn no matter who triggered it. The token represents the applying\/agent identification. Makes use of the client_credentials grant. The token\u2019s topic is the shopper itself.
\n On-behalf-of (OBO): the agent acts for a selected consumer, utilizing that consumer\u2019s present token. A consumer has already signed in someplace and there may be an inbound consumer token. The agent must name a downstream API as that consumer, so their permissions and identification carry via. AgentCore Identification exchanges the inbound consumer token for a downstream token that represents the consumer, whereas nonetheless authenticating itself with the shopper assertion. You should utilize RFC 8693 token trade or the RFC 7523 JWT authorization grant, relying on the identification supplier.
\n Consumer-delegated entry: the agent acts for a consumer, however the consumer grants consent interactively first. There isn’t any pre-existing token to trade. As an alternative, the consumer goes via an interactive login\/consent (the authorization code \/ three-legged OAuth movement), approving what the agent can do. After consent, the agent will get a token representing the consumer. Makes use of the authorization code grant.<\/p>\n
Stipulations<\/h2>\n
This publish assumes that you’ve got<\/p>\n
An AWS account with AWS Administration Console entry to KMS, AgentCore and AWS CloudTrail.
\n A tenant in your identification supplier, the place you’ll be able to register a public key for an software.
\n Discovery URL and Shopper ID that purchasers use to find and combine along with your identification supplier.
\n Affirm the signing algorithm your identification supplier requires for Personal Key JWT shopper authentication. Affirm the identical algorithm and key spec is supported by each AWS KMS and AgentCore Identification.
\n Permissions for every a part of the movement:<\/p>\n
Create and configure the KMS key \u2013 kms:CreateKey and kms:PutKeyPolicy.
\n Export the general public key to register along with your identification supplier \u2013 kms:GetPublicKey. (In case your identification supplier generates the important thing pair and offers you the personal key materials as an alternative, you additionally want kms:GetParametersForImport and kms:ImportKeyMaterial to import it into KMS.)
\n Create the credential supplier \u2013 bedrock-agentcore-control:CreateOauth2CredentialProvider.<\/p>\n
Getting began<\/h2>\n
The next sections present configure Personal Key JWT because the shopper authentication technique utilizing the AWS Administration Console.<\/p>\n
Step 1: Create the KMS signing key and register the general public key<\/h3>\n
Begin by creating an uneven KMS key that AgentCore Identification will use to signal the JWT shopper assertion. On this instance, we create the important thing in KMS and export the corresponding public key to the Identification supplier. Nevertheless, in case your identification supplier generates the important thing pair and offers you the personal key materials as an alternative, you’ll be able to import it to KMS.<\/p>\n
Open the AWS KMS console in the identical AWS Area as your credential supplier.
\n Select Buyer managed keys, then select Create key.
\n For Key kind, select Uneven.
\n For Key utilization, select Signal and confirm.
\n For Key spec, select a spec suitable along with your signing algorithm. This instance makes use of ECC_NIST_P256 with the ES256 signing algorithm.
\n Select Subsequent, enter an Alias, and proceed via the important thing administrator and key utilization permission steps.
\n On the Edit key coverage step, add the next assertion to the important thing coverage to grant AgentCore Identification permission to make use of the important thing, changing 111122223333 along with your AWS account ID and with AgentCore area in use. The kms:ViaService situation verifies the important thing can solely be used when the request originates via AgentCore Identification:<\/p>\n
\n “Id”: “BedrockAgentCoreIdentityPrivateKeyJwtAccess”,
\n “Model”: “2012-10-17”,
\n “Assertion”: [
\n {
\n “Effect”: “Allow”,
\n “Principal”: {
\n “AWS”: “arn:aws:iam::111122223333:root”
\n },
\n “Action”: [
\n “kms:Sign”,
\n “kms:DescribeKey”
\n ],
\n “Useful resource”: “*”,
\n “Situation”: {
\n “StringEquals”: {
\n “aws:ResourceAccount”: “${aws:PrincipalAccount}”
\n },
\n “StringLike”: {
\n “kms:ViaService”: “bedrock-agentcore-identity..amazonaws.com”
\n }
\n }
\n }
\n ]
\n}\n <\/div>\n
Select End. On the important thing\u2019s element web page, word the important thing ARN. You present it whenever you create the credential supplier.
\n Subsequent, export the general public key and register it along with your identification supplier:<\/p>\n
On the important thing\u2019s element web page, select the Public key tab and obtain the general public key. KMS offers a DER-encoded public key.
\n Convert the general public key into the format your supplier requires (for instance, an X.509 certificates for Microsoft Entra ID or a JSON Internet Key for Okta) and register it in your software.<\/p>\n
Step 2: Add an OAuth shopper<\/h3>\n
Open the Amazon Bedrock AgentCore console.
\n Within the left navigation pane, beneath Construct, select Identification.
\n Within the Outbound Auth part, select Add Outbound Auth, after which select Add OAuth shopper.<\/p>\n
![\"AgentCore](\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2026\/07\/28\/ML-21480-2.png\")
<\/p>\n
Determine 2 \u2013 Including an OAuth shopper from the AgentCore Identification console<\/p>\n
Step 3: Select Personal key JWT because the shopper authentication technique<\/h3>\n
On the Add OAuth Shopper web page, within the Supplier configurations part:<\/p>\n
For Configuration kind, select Discovery URL so AgentCore Identification can retrieve your supplier\u2019s configuration mechanically. (Select Guide config in case your supplier doesn’t publish a discovery endpoint.)
\n For Shopper authentication technique, select Personal key JWT.<\/p>\n
![\"Provider](\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2026\/07\/28\/ML-21480-3.png\")
<\/p>\n
Determine 3 \u2013 Deciding on Personal key JWT because the shopper authentication technique<\/p>\n
Step 4: Present the invention URL, shopper ID, KMS key and signing algorithm<\/h3>\n
For Discovery URL, enter the URL the place your supplier publishes its OpenID Join configuration (ending in .well-known\/openid-configuration).
\n For Shopper ID, enter the shopper identifier registered at your identification supplier.
\n For KMS key, select the ARN of your uneven KMS signing key. The important thing will need to have been created with SIGN_VERIFY as utilization and be in the identical Area for it to point out up within the checklist.<\/p>\n
Observe: You too can use a key from one other account in the identical Area by coming into that key\u2019s ARN. Cross-account entry requires further permissions in each accounts. See Permitting customers in different accounts to make use of a KMS key.<\/p>\n
For Signing algorithm, select the algorithm your identification supplier requires for Personal Key JWT. It have to be suitable along with your KMS key spec:<\/p>\n
![\"Console](\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2026\/07\/28\/ML-21480-4.png\")
<\/p>\n
Determine 4 \u2013 Offering the invention URL, shopper ID, uneven KMS key and signing algorithm<\/p>\n
Step 5: (Elective) Add claims, then create the shopper<\/h3>\n
In case your identification supplier requires extra claims within the JWT shopper assertion, add them right here:<\/p>\n
Below Header claims \u2013 non-compulsory, select Add header declare so as to add provider-specific header claims, reminiscent of a key identifier. The reserved keys alg and typ can’t be set.
\n Below Payload claims \u2013 non-compulsory, select Add payload declare so as to add provider-specific payload claims. The reserved keys iss, sub, jti, exp, iat, and nbf can’t be set.
\n Select Add OAuth Shopper.
\n Confirm that the credential supplier was created by checking that it seems within the Outbound Auth checklist.<\/p>\n
![\"Console](\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2026\/07\/28\/ML-21480-5.png\")
<\/p>\n
Determine 5 \u2013 Including non-compulsory header and payload claims earlier than creating the shopper<\/p>\n
Instance CloudTrail logs for the agent entry<\/h2>\n
When an agent makes use of the credential supplier to fetch a token, the operations are recorded on AWS CloudTrail so you’ll be able to audit every entry. You will note occasion names reminiscent of:<\/p>\n
GetWorkloadAccessToken (occasion supply bedrock-agentcore.amazonaws.com) \u2013 the agent obtains its workload identification token. The requestParameters file the workloadName, the assets block identifies the workload identification, and the returned token is redacted:<\/p>\n
\n “eventSource”:”bedrock-agentcore.amazonaws.com”,
\n “eventName”:”GetWorkloadAccessToken”,
\n “requestParameters”:{
\n “workloadName”:”my-agent-workload”
\n },
\n “responseElements”:{
\n “workloadAccessToken”:”HIDDEN_DUE_TO_SECURITY_REASONS”
\n },
\n “assets”:[
\n {
\n “accountId”:”111122223333″,
\n “type”:”AWS::BedrockAgentCore::WorkloadIdentity”,
\n “ARN”:”arn:aws:bedrock-agentcore:us-east-1:111122223333:workload-identity-directory\/default\/workload-identity\/my-agent-workload”
\n }
\n ]
\n}\n <\/div>\n
GetResourceOauth2Token (occasion supply bedrock-agentcore.amazonaws.com) \u2013 the agent requests an entry token for the downstream useful resource. The requestParameters present which credential supplier, scopes, and grant movement have been used, and the inbound token is redacted.<\/p>\n
\n “eventSource”:”bedrock-agentcore.amazonaws.com”,
\n “eventName”:”GetResourceOauth2Token”,
\n “requestParameters”:{
\n “workloadIdentityToken”:”HIDDEN_DUE_TO_SECURITY_REASONS”,
\n “resourceCredentialProviderName”:”my-private-key-jwt-provider”,
\n “scopes”:[
\n “https:\/\/graph.microsoft.com\/.default”
\n ],
\n “oauth2Flow”:”M2M”
\n },
\n “assets”:[
\n {
\n “accountId”:”111122223333″,
\n “type”:”AWS::BedrockAgentCore::OAuth2CredentialProvider”,
\n “ARN”:”arn:aws:bedrock-agentcore:us-east-1:111122223333:token-vault\/default\/oauth2credentialprovider\/my-private-key-jwt-provider”
\n }
\n ]
\n}\n <\/div>\n
Signal (occasion supply kms.amazonaws.com) \u2013 AgentCore Identification indicators the JWT shopper assertion along with your KMS key. That is the occasion that reveals Personal Key JWT working: userIdentity.invokedBy, sourceIPAddress, and userAgent are all bedrock-agentcore.amazonaws.com, confirming that AgentCore Identification referred to as kms:Signal in your behalf. Observe that the Signal occasion information the KMS signing algorithm identify, not the JWT algorithm identify you configured.<\/p>\n
\n “eventSource”:”kms.amazonaws.com”,
\n “eventName”:”Signal”,
\n “userIdentity”:{
\n “invokedBy”:”bedrock-agentcore.amazonaws.com”
\n },
\n “sourceIPAddress”:”bedrock-agentcore.amazonaws.com”,
\n “userAgent”:”bedrock-agentcore.amazonaws.com”,
\n “requestParameters”:{
\n “signingAlgorithm”:”RSASSA_PKCS1_V1_5_SHA_256″,
\n “keyId”:”arn:aws:kms:us-east-1:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab”,
\n “messageType”:”DIGEST”
\n },
\n “responseElements”:null,
\n “readOnly”:true,
\n “managementEvent”:true,
\n “assets”:[
\n {
\n “accountId”:”111122223333″,
\n “type”:”AWS::KMS::Key”,
\n “ARN”:”arn:aws:kms:us-east-1:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab”
\n }
\n ]
\n}\n <\/div>\n
Clear up<\/h2>\n
To keep away from incurring ongoing prices and to take away assets you now not want, clear up the credential supplier and the KMS signing key you created on this walkthrough.<\/p>\n
Take away the OAuth credential supplier<\/h3>\n
Open the Amazon Bedrock AgentCore console.
\n Within the left navigation pane, beneath Construct, select Identification.
\n Within the Outbound Auth part, find the credential supplier you created.
\n Choose the supplier, select Delete, and ensure the deletion.<\/p>\n
Schedule deletion of the KMS key<\/h3>\n
Deleting a KMS secret’s irreversible and everlasting. As soon as the secret’s deleted, any information or signatures that rely upon it may well now not be produced, so KMS requires you to schedule deletion with a ready interval relatively than deleting instantly. Earlier than you schedule deletion, affirm the secret’s now not referenced by any credential supplier or identification supplier registration. In case you are not sure whether or not the secret’s nonetheless in use, think about disabling the important thing as an alternative, which stops it from getting used whereas preserving it recoverable.<\/p>\n
Open the AWS KMS console within the Area the place you created the important thing.
\n Select Buyer managed keys, then choose the uneven signing key you created.
\n Select Key actions, then select Schedule key deletion.
\n Enter a ready interval between 7 and 30 days. Throughout this window the secret’s disabled however can nonetheless be recovered by canceling the scheduled deletion.
\n Affirm that you simply wish to schedule the important thing for deletion.<\/p>\n
After the ready interval elapses, KMS completely deletes the important thing. Keep in mind to additionally take away or rotate the corresponding public key you registered along with your identification supplier, so it now not trusts the retired key.<\/p>\n
Conclusion<\/h2>\n
By utilizing Personal Key JWT shopper authentication in AgentCore Identification, you can provide your brokers a secret-less, auditable method to authenticate to identification suppliers. The signing key stays on AWS KMS, each signing operation is recorded on AWS CloudTrail, and the identical credential supplier extends throughout M2M, on-behalf-of, and user-delegated flows. For end-to-end samples, together with Entra and Okta identity-provider registration and each M2M and OBO flows, see the Amazon Bedrock AgentCore samples on GitHub.<\/p>\n
![\"\"](\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2026\/07\/28\/swara.jpeg\")
<\/p>\n<\/p><\/div>\n![\"Satveer](\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2026\/07\/28\/ML-21480-6.jpg\")
<\/p>\n<\/p><\/div>\n