Application & API Security

OAuth 2.0 Private Key JWT Client Authentication

Client authentication method where a confidential client proves its identity to the authorization server by signing a JWT assertion with its private key, instead of sending a shared client secret, and then uses the issued access token to call a protected API.

Private Key JWT is a client authentication method for the token endpoint. Rather than sending a shared client secret, the client signs a short-lived JSON Web Token (the client assertion) with a private key that never leaves its control. The authorization server verifies the signature with the matching public key registered for that client, so no secret is ever transmitted or stored by the server.

The method is used with any grant that calls the token endpoint (such as client credentials or authorization code) and is a common requirement in high-security profiles such as FAPI. The diagram below uses it with the client credentials grant.

Resource ServerAuthorization ServerClient AppResource ServerAuthorization ServerClient AppRegistration stageAuthentication stageGenerate key pair1Register public key or JWKS URI2Create and sign client assertion JWT3POST /oauth/token (client_assertion)4Retrieve client public key5Verify signature and validate claims6access_token7GET /api/resource8Validate access token9200 OK - Resource payload10

Official specifications

Additional resources