Okta Invalid Client Error Occurs When Creating a Private Key JWT with Multiple Key Pairs
Last Updated:
Overview
An Okta invalid client error occurs during Private Key JSON Web Token (JWT) authentication if a client application possesses multiple public and private key pairs but fails to specify the Key ID in the token header. Resolve this error by including the exact Key ID parameter in the header of the signed JWT to allow Okta to identify the correct public key for signature verification. When the Key ID is omitted, Okta generates the following error:
{"error":"invalid_client","error_description":"The client_assertion JWT kid is invalid."}
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- JSON Web Token (JWT)
- OAuth 2.0 / OpenID Connect (OIDC)
- Private Key JWT Client Authentication
- Okta API
Cause
When an OAuth 2.0 client application registers multiple public keys for Private Key JWT authentication, Okta requires a Key ID (kid) to determine which public key to use for signature verification. If the client_assertion JWT header omits the kid claim, Okta cannot match the assertion to the correct public key, resulting in a signature validation failure.
Solution
How is the Key ID added to the Private Key JWT header?
Configure the client application to include the Key ID in the JSON Web Key (JWK) header of the signed assertion to ensure Okta can verify the signature.
- Locate the Key ID (
kid) associated with the specific public key registered in the Okta OpenID Connect application. - Configure the application code or JWT library to inject the
kidclaim into the header of the signed JWT (client_assertion). - Verify that the
kidvalue in the JWT header exactly matches thekidvalue of the registered public key in Okta.
Review the following configuration to ensure the Key ID parameter is correctly present in the JWK header:
