Note that this is the same post as this Idea post: Idea Details. I want to gain more traction by crossposting it and discuss with more people about the functionality. It's an important feature for us.
We are currently running API Developer Portal version 5.4.1.3 and would like to request support for private-key-jwt authentication for Portal Managed applications. This is requested already a long time ago in this topic: https://community.broadcom.com/idea/api-portal-support-for-oauth-client-registration-with-private-key-jwt.
This authentication method is already available within the OAuth Manager, where it is possible to create a client and configure it to use private-key-jwt successfully. We are looking for equivalent functionality within the API Developer Portal, with corresponding PAPI support.
Since version 5.3.2, a similar capability appears to be available via the PAPI, specifically through the /api-management/0.1/applications/{{app_uuid}}/oauth/clients endpoint. However, this endpoint currently requires the use of Dynamic Client Registration (DCR). Our existing Portal Managed auth provider is not DCR-based, and it is unclear to us why DCR would be a prerequisite for this functionality.
Additionally, the endpoint requires a large JSON payload. For private-key-jwt, we would expect that providing a JWKS or JWKS URI should be sufficient, consistent with the behavior in the OAuth Manager.
Our goal is straightforward: the possibility to replace some client ID + client secret authentication with client ID + private-key-jwt, while retaining our existing non-DCR auth provider.
This is an important step for our organization. We are a government entity responsible for delivering highly sensitive personal data, and it is critical that we can guarantee our clients authenticate using their private key at all times. This level of assurance is essential for compliance and security purposes.
We hope this feature can be available in the near future.
-------------------------------------------