Authenticate with Private Key JWT using Amazon Bedrock AgentCore Identity

This article announces Private Key JWT client authentication support in Amazon Bedrock AgentCore Identity, allowing agents to authenticate to downstream identity providers using KMS-signed JWT assertions.

• Agents sign JWT assertions with AWS KMS asymmetric keys instead of using shared OAuth secrets
• Supports three grant flows: machine-to-machine, on-behalf-of, and user-delegated access
• Public key registered with identity provider; private key remains secure in AWS KMS
• All signing operations auditable through AWS CloudTrail for compliance
• Compatible with RS256, PS256, and ES256 signing algorithms
• Step-by-step console configuration for creating KMS keys and OAuth clients

Private Key JWT authentication provides a secret-less, auditable authentication method for agents accessing downstream APIs and services.