# 403 error code for bearer token generated with correct scope - Okta.NET SDK **URL:** \ **Category:** OAuth/OIDC\ **Tags:** o4o\ **Created:** [October 4, 2024, 9:12am UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816 "2024-10-04T09:12:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![danoroian-perficient](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@danoroian-perficient](https://devforum.okta.com/u/danoroian-perficient)\ **Post date:** [October 4, 2024, 9:12am UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816/1 "2024-10-04T09:12:35Z")
We have an app service with private/public key credentials for authentication. We initialize an OAuthApi with the following configuration : var privateKey = File.ReadAllText(“privatekey.json”); var config = new Configuration { OktaDomain = “https:devoktainstance.okta.com”, AuthorizationMode = AuthorizationMode.PrivateKey, ClientId = “clientIdreplaced”, Scopes = [“okta.apps.manage”], PrivateKey = new JsonWebKeyConfiguration(privateKey), }; var oAuthApi = new OAuthApi(config); var accessToken = await oAuthApi.GetBearerTokenAsync(); // we receive what it seems to be a valid token with correct scope granted. We get accessToken back with correct claim for scopes: “scp”: [ “okta.apps.manage” ] However when trying to send a request to {{url}}/api/v1/apps/{{applicationId}}/credentials/jwks To add a new JWKs key in order to have and facilitate key rotation we received a 403 error: { “errorCode”: “E0000006”, “errorSummary”: “You do not have permission to perform the requested action”, “errorLink”: “E0000006”, “errorId”: “oaeiShl7lazQcCxeUc2tLIIsg”, “errorCauses”: } Even though as per documentation okta.apps.manage scope is granted in the application and set on token. Documentation link : [Add Json Web Key](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationSSOCredentialOAuth2ClientAuth/#tag/ApplicationSSOCredentialOAuth2ClientAuth/operation/addJwk) We are considering the 2nd possibility to do key-rotation by providing an api/url to Okta for fetching dynamically the keys but we`re not comfortable with having an public api exposing this without an extra security/auth method for it. Also Super Administrator is set in Admin roles. What can we do and what are we missing here ? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [October 4, 2024, 4:31pm UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816/2 "2024-10-04T16:31:01Z")
While you can receive a token with this scope upon requesting it (and it being granted to the application), the application itself may not have permissions to the appropriate resource set based on the assigned admin roles. What admin roles have you assigned to the API Service application you made within Okta? Does this admin role have sufficient permissions to manage applications? Here’s a quick explanation of this Silent Downscoping from our [docs](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/#silent-downscoping): > The Okta [org authorization server](https://developer.okta.com/docs/concepts/auth-servers/) returns all scopes that you request. It returns all requested scopes as long as the client app is permitted to use that scope (granted to the client app). It doesn’t matter whether you have permissions for all the scopes that you request. If the scopes requested exist in the app’s grants collection, those scopes are sent back in the access token. However, when you make requests to perform actions that you don’t have permissions for, the token doesn’t work, and you receive an error. > For example, if you’re a Read Only Admin and request an access token that contains the `okta.authorizationServers.manage` scope and that scope exists in the client’s grants collection, the access token returned contains that scope. However, the access token doesn’t work when you try to modify an authorization server on `/api/v1/authorizationServers` because you lack the permissions. ---
**Author:** ![danoroian-perficient](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@danoroian-perficient](https://devforum.okta.com/u/danoroian-perficient)\ **Post date:** [October 7, 2024, 5:43am UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816/3 "2024-10-07T05:43:12Z")
Hi @andrea. Thanks for the quick answer. We have set Super Administrator as the admin role and okta.apps.manage is granted to the application. ---
**Author:** ![danoroian-perficient](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@danoroian-perficient](https://devforum.okta.com/u/danoroian-perficient)\ **Post date:** [October 15, 2024, 8:35am UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816/4 "2024-10-15T08:35:07Z")
Hi @andrea . Are there any updates regarding this ? We haven`t yet figured out how to make this work. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [October 15, 2024, 4:54pm UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816/5 "2024-10-15T16:54:30Z")
I’m not seeing anything obvious that you’ve done wrong, the Super Admin role + the `okta.apps.manage` scope _should_ be sufficient. With a token like this, are you able to manage other aspects of applications? For example, are you at least able to create a new one? ---
**Author:** ![danoroian-perficient](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@danoroian-perficient](https://devforum.okta.com/u/danoroian-perficient)\ **Post date:** [October 16, 2024, 6:14am UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816/6 "2024-10-16T06:14:34Z")
Hi @andrea . Yes, we are able to manage other aspects of applications such as activating/deactivating an application which also requires okta.apps.manage . Could this be a bug ? ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [November 15, 2024, 6:14am UTC](https://devforum.okta.com/t/403-error-code-for-bearer-token-generated-with-correct-scope-okta-net-sdk/30816/7 "2024-11-15T06:14:38Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.