Okta - Client secret rotation and key management - Use a URL to fetch keys dynamically option

[danoroian-perficient]

Hi, we are currently in analysis to implement client secret rotation for an okta application service.

According to this guide we are exploring the Use a URL to fetch keys dynamically option:

Client secret rotation and key management | Okta Developer

However there doesn`t seem to be any info about any possible authentication mechanism or ways for us to secure this endpoint that will get the public keys. Are there any possible ways to add some security around it ?

Thanks

[nikitag]

Hi there, Okta’s Keys endpoint https:/{yourOktaDomain}/oauth2/v1/keys is a public metadata endpoint and has only public keys which are not considered a security issue while sharing.
If you have specific security questions, let us know.