Authorization Server Public Keys

Provides operations to manage public JSON Web Key credentials used for encrypting tokens minted by the custom authorization server.

List all Custom Authorization Server Public JSON Web Keys
Early Access
OAuth 2.0 scopes:
  • okta.authorizationServers.read

Lists all the public keys used by the custom authorization server

Request
path Parameters
authServerId
required
string

id of the Authorization Server

Example: GeGRTEr7f3yu2n7grw22
Responses
200

Success

401

Unauthorized

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys
Request samples 
Response samples 
application/json
[
  • {
    • "status": "ACTIVE",
    • "id": "apk40n33xfjbPaf6D0g5",
    • "e": "AQAB",
    • "n": "g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3, WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ",
    • "kid": "RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc",
    • "kty": "RSA",
    • "use": "enc",
    • "created": "2023-04-06T21:32:33.000Z",
    • "lastUpdated": "2023-04-06T21:32:33.000Z",
    • "_links": {}
    },
  • {
    • "status": "INACTIVE",
    • "id": "apk33a45xfjbDfg6D0g5",
    • "e": "AQAB",
    • "n": "l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK 3 HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37 - XDIDb0XG - R8DOoOHLJPTpsgH - rJe M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX - 0 TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 OtsOnmc3NLIGXB - GeDiUZiBYQdPR - myB4ZoQ",
    • "kid": "Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo",
    • "kty": "RSA",
    • "use": "enc",
    • "created": "2023-04-06T21:32:33.000Z",
    • "lastUpdated": "2023-04-06T21:32:33.000Z",
    • "_links": {}
    }
]
Add a JSON Web Key
Early Access
OAuth 2.0 scopes: 
  • okta.authorizationServers.manage
Adds a new JSON Web Key to the custom authorization server`s JSON web keys.




Note: This API doesn't allow you to add a key if the existing key doesn't have a kid. Use the Replace an Authorization Server operation to update the JWKS or Delete a Custom Authorization Server Public JSON Web Key and re-add the key with a kid.
Note: This API doesn't allow you to add a key with an ACTIVE status. You need to add an INACTIVE key first, and then ACTIVATE the key.




Request 
path Parameters
authServerId
required
string
id of the Authorization Server


 
 Example:  GeGRTEr7f3yu2n7grw22
Request Body schema: application/json
required
e
string
RSA key value (exponent) for key binding


 
kid
string or null
Unique identifier of the JSON web key in the custom authorization server's public JWKS


 
kty
string
Cryptographic algorithm family for the certificate's key pair


 
n
string
RSA key value (modulus) for key binding


 
status
string
Status of the JSON Web Key


 Enum: "ACTIVE" "INACTIVE"  
use
string
Acceptable use of the JSON Web Key


 
Responses 
201
Created


400
Bad Request


401
Unauthorized


403
Forbidden


429
Too Many Requests


post/api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys
Request samples 
application/json
{
  • "kid": "ASHJHGasa782333-Sla3x3POBiIxDreBCdZuFs5B",
  • "kty": "RSA",
  • "use": "enc",
  • "e": "AQAB",
  • "n": "AJncrzOrouIUCSMlRL0HU.....Kuine49_CEVR4GPn=",
  • "status": "INACTIVE"
}
Response samples 
application/json
{}
Retrieve a Custom Authorization Server Public JSON Web Key
Early Access
OAuth 2.0 scopes: 
  • okta.authorizationServers.read
Retrieves a custom authorization server public JSON web key by key id


Request 
path Parameters
authServerId
required
string
id of the Authorization Server


 
 Example:  GeGRTEr7f3yu2n7grw22
keyId
required
string
Unique id of the Custom Authorization Server JSON Web Key


 
 Example:  apk2f4zrZbs8nUa7p0g4
Responses 
200
OK


401
Unauthorized


403
Forbidden


404
Not Found


429
Too Many Requests


get/api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys/{keyId}
Request samples 
Response samples 
application/json
{}
Delete a Custom Authorization Server Public JSON Web Key
Early Access
OAuth 2.0 scopes: 
  • okta.authorizationServers.manage
Deletes a custom authorization server public JSON web key by key id. You can only delete an inactive key.


Request 
path Parameters
authServerId
required
string
id of the Authorization Server


 
 Example:  GeGRTEr7f3yu2n7grw22
keyId
required
string
Unique id of the Custom Authorization Server JSON Web Key


 
 Example:  apk2f4zrZbs8nUa7p0g4
Responses 
204
No Content


400
Bad Request


401
Unauthorized


403
Forbidden


404
Not Found


429
Too Many Requests


delete/api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys/{keyId}
Request samples 
Response samples 
application/json
{
  • "errorCode": "E0000001",
  • "errorSummary": "Api validation failed: JsonWebKey",
  • "errorLink": "E0000001",
  • "errorId": "sampleQPivGUj_ND5v78vbYWW",
  • "errorCauses": [
    • {
      }
    ]
}
Activate a Custom Authorization Server Public JSON Web Key
Early Access
OAuth 2.0 scopes: 
  • okta.authorizationServers.manage
Activates a custom authorization server public JSON web key by key id.




Note: You can have only one active key at any given time for the authorization server. When you activate an inactive key, Okta automatically deactivates the current active key.




Request 
path Parameters
authServerId
required
string
id of the Authorization Server


 
 Example:  GeGRTEr7f3yu2n7grw22
keyId
required
string
Unique id of the Custom Authorization Server JSON Web Key


 
 Example:  apk2f4zrZbs8nUa7p0g4
Responses 
200
OK


401
Unauthorized


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys/{keyId}/lifecycle/activate
Request samples 
Response samples 
application/json
{}
Deactivate a Custom Authorization Server Public JSON Web Key
Early Access
OAuth 2.0 scopes: 
  • okta.authorizationServers.manage
Deactivates a custom authorization server public JSON web key by key id.




Note: Deactivating the active key isn't allowed if the authorization server has access token encryption enabled. You can activate another key, which makes the current key inactive.




Request 
path Parameters
authServerId
required
string
id of the Authorization Server


 
 Example:  GeGRTEr7f3yu2n7grw22
keyId
required
string
Unique id of the Custom Authorization Server JSON Web Key


 
 Example:  apk2f4zrZbs8nUa7p0g4
Responses 
200
OK


400
Bad Request


401
Unauthorized


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys/{keyId}/lifecycle/deactivate
Request samples 
Response samples 
application/json
{}