Amazon Bedrock AgentCore Identity now supports Private Key JWT client authentication for agents, enabling authentication to a downstream identity provider’s token endpoint using a signed JSON Web Token (JWT) client assertion instead of a shared OAuth 2.0 client secret. A public key is registered with the identity provider, while the corresponding private key remains in AWS Key Management Service (AWS KMS). AgentCore Identity uses AWS KMS to sign the assertion and sends it to the identity provider, which verifies it using the registered public key. The post explains how this authentication works, reviews supported grant flows, and walks through creating an AWS KMS signing key, registering its public key, configuring a credential provider on the AWS Management Console, and reviewing example AWS CloudTrail events. In the example request flow, a customer-support agent calls GetResourceOauth2Token on AgentCore Identity to request a token for an orders API. AgentCore Identity reads the client ID, KMS key ARN, and signing algorithm from the credential provider, builds a short-lived JWT client assertion, and calls kms:Sign using the configured algorithm (RS256, PS256, or ES256). The private key never leaves KMS. AgentCore Identity posts the signed assertion to the token endpoint with grant_type=client_credentials and client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer. The identity provider verifies the signature and