Rotate JWKS public/private keypair on Service App

[abta]

We are using Service App (client credentials grant flow) with Okta Java SDK to access Okta API.

I have created the Service App by following

Implement OAuth for Okta with a service app | Okta Developer

We need to rotate the JWKS/public private keys, looks like I can update the public key using “Update Client Application” (see link below), but I don’t see how to specify the key to be used on the Client (old vs new key, when the key is updated)

Dynamic Client Registration | Okta Developer

I found below link, and it looks like the key id (“kid”), needs to be set to specify the key to be used, but I don’t see a way to set the kid using Okta Java SDK.

How to rotate public/private key pair using client credentials grant flow?

I am trying to update an existing client. Can you explain what you mean why using “an API key to update an existing client”? The reason I am trying to update the existing client is so we can rotate the key pair. I wanted to add another key, switch our application over, and then delete the previous key. In order to do this, will I need to use a new client?

[okra-okta]

Since you’re using OAuth for Okta, you are using the org authorization server.

Unfortunately, you can not rotate the keys manually but Okta will rotate them automatically.

You can’t manually rotate the Org Authorization Server’s signing keys.

Key Rotation | Okta Developer

[abta]

I was talking about rotating the keys/key pair on Service app (Overview | Okta Developer)

And below how we connect to Okta API via Okta Java SDK.

Client client = Clients.builder()
.setOrgUrl(orgUrl)
.setClientId(client id of the service app)
.setAuthorizationMode(AuthorizationMode.PRIVATE_KEY)
.setPrivateKey(privateKey())
setScopes(okta api scopes)
.build();

Note the privateKey() method above, returns the Private Key, my questions how to rotate the public key on the Okta Service app ? That way if the public key is rotated, the privateKey() method will return new private key associated with the latest public key update on the Service App.

[okra-okta]

Sorry I misread your question. You’re correct, you can use the Clients endpoint to update the JWKS for the service app. It would be similar to the step from here:
https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/create-serviceapp-grantscopes/#create-a-service-app

Note: You can’t use the access token from a service app to update the JWKS for the service app itself. You will need to use an Okta API token instead to make the request.