Authenticate with Private Key JWT using Amazon Bedrock AgentCore Identity

Authenticate with Private Key JWT using Amazon Bedrock AgentCore Identity should be explained through that lens before any broad claim is made. Amazon Bedrock AgentCore Identity now supports Private Key JWT client authentication for agents. This post explains how Private Key JWT client authentication works in AgentCore Identity and reviews the supported grant flows. The piece keeps the context, impact, and follow-up signals in view so readers do not stop at the headline.

What happened

Amazon Bedrock AgentCore Identity now supports Private Key JWT client authentication for agents. With Private Key JWT client authentication, your agents can authenticate to a downstream identity provider’s token endpoint using a signed JSON Web Token (JWT) client assertion instead of a shared OAuth 2. 0 client secret. You can register a public key with your identity provider, while the corresponding private key stays in an AWS Key Management Service (AWS KMS). To authenticate, AgentCore Identity uses AWS KMS to sign the assertion and sends the signed assertion to the identity provider, which verifies it using the public key you registered.

Practical impact for readers

This post explains how Private Key JWT client authentication works in AgentCore Identity and reviews the supported grant flows. We then walk through creating an AWS KMS signing key, registering its public key with your identity provider, configuring a credential provider on the AWS Management Console, and reviewing example AWS CloudTrail events that record your agent’s access.

Details worth verifying

The following example illustrates the request flow. Consider a customer-support agent that needs to read a customer’s order history from an internal orders API protected by your identity provider.

Who should act or wait

Figure 1 – Example request flow for a machine-to-machine token request, from the agent’s call through to the downstream API. After the first update lands, the follow-up worth watching is rollout speed, stability, and whether the useful parts stay locked behind paid tiers. That is why the useful reading move is not to stop at the headline, but to compare the promise, the workflow change, and the likely cost before deciding anything.

What is still unclear

The following sections show how to configure Private Key JWT as the client authentication method using the AWS Management Console.

Source notes

AWS ML Blog