Okta generates an error when an application attempts to obtain an access token using the OAuth 2.0 Client Credentials grant type against the Org Authorization Server without using the Public Key / Private Key authentication method. Administrators resolve this by updating the application client authentication method to use a public and private key pair. The application receives the following error:

Client Credentials requests to the Org Authorization Server must use the private_key_jwt token_endpoint_auth_method.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OAuth 2.0
• Org Authorization Server
• Client Credentials Grant Type

The Org Authorization Server enforces a higher security standard for machine-to-machine (M2M) authentication compared to custom authorization servers. It requires that applications using the Client Credentials grant type authenticate themselves using the Public Key / Private Key method (private_key_jwt). This method uses a signed JSON Web Token (JWT) for client authentication. This is more secure because the private key never leaves the application.

The error occurs because the OAuth 2.0 application in Okta is configured to use a different client authentication method, such as Client Secret, when making the token request.

Why does Okta require the private key JWT authentication method?

The Org Authorization Server enforces strict security requirements for machine-to-machine authentication. Okta requires the private_key_jwt method to ensure that the private key remains secure within the application and uses a signed JSON Web Token (JWT) for authentication.

Update the application client authentication method to use a public and private key pair.

1. Log in to the Okta Admin Console as an administrator.
2. Navigate to Applications > Applications and select the target application.
3. On the application's profile page, select the General tab.
4. Scroll to the Client Authentication section and click Edit.
5. Select the Public key / Private key option.
6. Choose how to provide the public key:
   • Save keys in Okta: Paste the public key in JWK format into the text box.
   • Use a URL: Provide a URL that hosts the public key set in JWKS format.
7. Click Save.

Update the application code to generate a signed client assertion.

Modify the application code to generate a signed client assertion JSON Web Token (JWT) to call the token endpoint, instead of passing the client ID and client secret.

NOTE: The application must generate a signed client assertion JWT to successfully authenticate against the Org Authorization Server. Follow the steps in this guide to complete this flow: Implement OAuth for Okta with a service app.

Related References

• Client authentication methods
• Implement the Client Credentials flow
• Implement OAuth for Okta with a service app
• Build a JWT for client authentication