Identity Provider Signing Keys

The Identity Provider Signing Keys API provides operations to manage signing key credentials and certificate signing requests (CSRs) for identity providers (IdPs).

Note: Okta currently uses the same key for both request signing and the decryption of SAML assertions that the IdP encrypts. Changing your signing key also changes your decryption key.

List all certificate signing requests
OAuth 2.0:
  • okta.idps.read

Lists all certificate signing requests (CSRs) for an identity provider (IdP)

Request
path Parameters
idpId
required
string

id of IdP

Example: 0oa62bfdjnK55Z5x80h7
Responses
200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/idps/{idpId}/credentials/csrs
Request samples 
Response samples 
application/json
[
  • {
    • "id": "h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50",
    • "created": "2017-03-28T01:11:10.000Z",
    • "csr": "MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=",
    • "kty": "RSA",
    • "_links": {}
    },
  • {
    • "id": "-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg",
    • "created": "2017-03-28T01:21:10.000Z",
    • "csr": "MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=",
    • "kty": "RSA",
    • "_links": {}
    }
]
Generate a certificate signing request
OAuth 2.0: 
  • okta.idps.manage
Generates a new key pair and returns a certificate signing request (CSR) for it




Note: The private key isn't listed in the signing key credentials for the identity provider (IdP) until it's published.




Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
Request Body schema: application/json
required
object (CsrMetadataSubject) 
 
commonName
string
Common name of the subject


 
countryName
string
Country name or code


 
localityName
string
Locality (city) name


 
organizationalUnitName
string
Name of the smaller organization, for example, the department or the division


 
organizationName
string
Large organization name


 
stateOrProvinceName
string
State or province name


 
object (CsrMetadataSubjectAltNames) 
 
dnsNames
Array of strings
DNS names of the subject


 
Responses 
201
Created


400
Bad Request


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/idps/{idpId}/credentials/csrs
Request samples 
application/json
{
  • "subject": {
    • "commonName": "SP Issuer",
    • "countryName": "US",
    • "localityName": "San Francisco",
    • "organizationalUnitName": "Dev",
    • "organizationName": "Okta, Inc.",
    • "stateOrProvinceName": "California"
    },
  • "subjectAltNames": {
    • "dnsNames": [
      ]
    }
}
Response samples 
{
  • "id": "h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50",
  • "created": "2017-03-28T01:11:10.000Z",
  • "csr": "MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=",
  • "kty": "RSA",
  • "_links": {}
}
Retrieve a certificate signing request
OAuth 2.0: 
  • okta.idps.read
Retrieves a specific certificate signing request (CSR) by id


Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
idpCsrId
required
string
id of the IdP CSR


 
 Example:  1uEhyE65oV3H6KM9gYcN
Responses 
200
Success


403
Forbidden


404
Not Found


429
Too Many Requests


get/api/v1/idps/{idpId}/credentials/csrs/{idpCsrId}
Request samples 
Response samples 
{
  • "id": "h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50",
  • "created": "2017-03-28T01:11:10.000Z",
  • "csr": "MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=",
  • "kty": "RSA",
  • "_links": {}
}
Revoke a certificate signing request
OAuth 2.0: 
  • okta.idps.manage
Revokes a certificate signing request (CSR) and deletes the key pair from the identity provider (IdP)


Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
idpCsrId
required
string
id of the IdP CSR


 
 Example:  1uEhyE65oV3H6KM9gYcN
Responses 
204
No Content


403
Forbidden


404
Not Found


429
Too Many Requests


delete/api/v1/idps/{idpId}/credentials/csrs/{idpCsrId}
Request samples 
Response samples 
application/json
{
  • "errorCode": "E0000006",
  • "errorSummary": "You do not have permission to perform the requested action",
  • "errorLink": "E0000006",
  • "errorId": "sampleNUSD_8fdkFd8fs8SDBK",
  • "errorCauses": [ ]
}
Publish a certificate signing request
OAuth 2.0: 
  • okta.idps.manage
Publishes the certificate signing request (CSR) with a signed X.509 certificate and adds it into the signing key credentials for the identity provider (IdP)




Notes:


    

  • Publishing a certificate completes the lifecycle of the CSR, and it's no longer accessible.
    • 

  • If the validity period of the certificate is less than 90 days, a 400 error response is returned.
    • 





Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
idpCsrId
required
string
id of the IdP CSR


 
 Example:  1uEhyE65oV3H6KM9gYcN
Request Body schema: 
required
string <binary> 
X.509 certificate in DER format. 
The client can either post in binary or Base64URL-encoded. If the post is Base64URL-encoded, set the Content-Transfer-Encoding header to base64.


 
Responses 
201
Created


400
Bad Request


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/idps/{idpId}/credentials/csrs/{idpCsrId}/lifecycle/publish
Request samples 
Response samples 
application/json
{
  • "created": "2016-01-03T18:15:47.000Z",
  • "e": "AQAB",
  • "expiresAt": "2016-01-03T18:15:47.000Z",
  • "kid": "your-key-id",
  • "kty": "RSA",
  • "lastUpdated": "2016-01-03T18:15:47.000Z",
  • "n": "101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747",
  • "use": "sig",
  • "x5c": [
    • "MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9"
    ],
  • "x5t#S256": "wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE"
}
List all signing key credentials for IdP
OAuth 2.0: 
  • okta.idps.read
Lists all signing key credentials for an identity provider (IdP)


Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
Responses 
200
Success


403
Forbidden


404
Not Found


429
Too Many Requests


get/api/v1/idps/{idpId}/credentials/keys
Request samples 
Response samples 
application/json
[
  • {
    • "created": "2015-12-10T18:56:23.000Z",
    • "expiresAt": "2017-12-10T18:56:22.000Z",
    • "x5c": [
      ],
    • "kid": "akm5hvbbevE341ovl0h7",
    • "kty": "RSA",
    • "use": "sig",
    • "x5t#S256": "5GOpy9CQVtfvBmu2T8BHvpKE4OGtC3BuS046t7p9pps"
    },
  • {
    • "created": "2015-12-10T18:55:35.000Z",
    • "expiresAt": "2045-01-23T02:15:23.000Z",
    • "x5c": [
      ],
    • "kid": "akm5hvbn1vojA9Fsa0h7",
    • "kty": "RSA",
    • "use": "sig",
    • "x5t#S256": "7CCyXWwKzH4P6PoBP91B1S_iIZVzuGffVnUXu-BTYQQ"
    }
]
List the active signing key credential for IdP
CORS
OAuth 2.0: 
  • okta.idps.read
Lists the active signing key credential for an identity provider (IdP)


Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
Responses 
200
Success


204
No Content


429
Too Many Requests


get/api/v1/idps/{idpId}/credentials/keys/active
Request samples 
Response samples 
application/json
[
  • {
    • "kty": "RSA",
    • "created": "2025-04-14T16:29:59.000Z",
    • "lastUpdated": "2025-04-14T16:29:59.000Z",
    • "expiresAt": "2035-04-14T16:29:59.000Z",
    • "kid": "your-key-id",
    • "use": "sig",
    • "x5c": [
      ],
    • "x5t#S256": "pX0kpGWPotMaEqqtIoOH9L-sFBa-htNFu0MZiJz1Hi4",
    • "e": "AQAB",
    • "n": "wdmW7pNqxzmlrsWbHq6rQJDiMu4T344AKEzQ1jGffyCLCU-HKk5WqIVtQ4EJ5FU3Rk6kNeoTdkQbxn7t2QFj37ScHZkxXDbNEhFbZpvGh7-rYBG7TCnk8jO9ct_bpT-PCLCgC9L_67H2eCXXN-_gFVZAx7KEibb4NgUET2p34b5scGI2LwEefS-z8UBGlNkg9+SmI9PvjMXplFKazb6qlb27fp0PSfC4S5g8kOCqEGC9oNOCBHO5jyzlzcFq04AIaAX9N1X13UULrj-262O1-RCnQNTadbdrO6FXwfQ6lsLmvWCFBVzLTqxYxCGNY85lhAH1zjoEvXnInKYgnvmcuw"
    }
]
Generate a new signing key credential for IdP
OAuth 2.0: 
  • okta.idps.manage
Generates a new X.509 certificate for an identity provider (IdP) signing key credential to be used for signing assertions sent to the IdP. IdP signing keys are read-only.




Note: To update an IdP with the newly generated key credential, update your IdP using the returned key's kid in the signing credential.




Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
query Parameters
validityYears
required
integer <int32>   [ 2 .. 10 ] 
expiry of the IdP key credential


 
Responses 
200
Success


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/idps/{idpId}/credentials/keys/generate
Request samples 
Response samples 
application/json
{
  • "created": "2015-12-10T18:56:23.000Z",
  • "expiresAt": "2017-12-10T18:56:22.000Z",
  • "kid": "akm5hvbbevE341ovl0h7",
  • "kty": "RSA",
  • "use": "sig",
  • "x5c": [
    • "MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9"
    ],
  • "x5t#S256": "wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE"
}
Retrieve a signing key credential for IdP
OAuth 2.0: 
  • okta.idps.read
Retrieves a specific identity provider (IdP) key credential by kid


Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
kid
required
string
Unique id of the IdP key credential


 
 Example:  KmMo85SSsU7TZzOShcGb
Responses 
200
Success


403
Forbidden


404
Not Found


429
Too Many Requests


get/api/v1/idps/{idpId}/credentials/keys/{kid}
Request samples 
Response samples 
application/json
{
  • "created": "2015-12-10T18:56:23.000Z",
  • "expiresAt": "2017-12-10T18:56:22.000Z",
  • "kid": "akm5hvbbevE341ovl0h7",
  • "kty": "RSA",
  • "use": "sig",
  • "x5c": [
    • "MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9"
    ],
  • "x5t#S256": "wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE"
}
Clone a signing key credential for IdP
OAuth 2.0: 
  • okta.idps.manage
Clones an X.509 certificate for an identity provider (IdP) signing key credential from a source IdP to target IdP




Caution: Sharing certificates isn't a recommended security practice.






Note: If the key is already present in the list of key credentials for the target IdP, you receive a 400 error response.




Request 
path Parameters
idpId
required
string
id of IdP


 
 Example:  0oa62bfdjnK55Z5x80h7
kid
required
string
Unique id of the IdP key credential


 
 Example:  KmMo85SSsU7TZzOShcGb
query Parameters
targetIdpId
required
string
id of the target IdP


 
Responses 
201
Created


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/idps/{idpId}/credentials/keys/{kid}/clone
Request samples 
Response samples 
application/json
{
  • "created": "2015-12-10T18:56:23.000Z",
  • "expiresAt": "2017-12-10T18:56:22.000Z",
  • "kid": "akm5hvbbevE341ovl0h7",
  • "kty": "RSA",
  • "use": "sig",
  • "x5c": [
    • "MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9"
    ],
  • "x5t#S256": "wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE"
}