keys

Creates, updates, deletes, gets or lists a keys resource.

Overview

Name	keys
Type	Resource
Id	okta.apps.keys

Fields

The following fields are returned by SELECT queries:

get_application_key

Name	Datatype	Description
created	string (date-time)	Timestamp when the object was created (example: 2017-03-28T01:11:10.000Z)
e	string	RSA key value (public exponent) for Key binding
expiresAt	string (date-time)	Timestamp when the certificate expires
kid	string	Unique identifier for the certificate
kty	string	Cryptographic algorithm family for the certificate's keypair. Valid value: RSA
lastUpdated	string (date-time)	Timestamp when the object was last updated
n	string	RSA modulus value that is used by both the public and private keys and provides a link between them
use	string	Acceptable use of the certificate. Valid value: sig
x5c	array	X.509 certificate chain that contains a chain of one or more certificates
x5t#S256	string	X.509 certificate SHA-256 thumbprint, which is the base64url-encoded SHA-256 thumbprint (digest) of the DER encoding of an X.509 certificate

list_application_keys

Name	Datatype	Description
created	string (date-time)	Timestamp when the object was created (example: 2017-03-28T01:11:10.000Z)
e	string	RSA key value (public exponent) for Key binding
expiresAt	string (date-time)	Timestamp when the certificate expires
kid	string	Unique identifier for the certificate
kty	string	Cryptographic algorithm family for the certificate's keypair. Valid value: RSA
lastUpdated	string (date-time)	Timestamp when the object was last updated
n	string	RSA modulus value that is used by both the public and private keys and provides a link between them
use	string	Acceptable use of the certificate. Valid value: sig
x5c	array	X.509 certificate chain that contains a chain of one or more certificates
x5t#S256	string	X.509 certificate SHA-256 thumbprint, which is the base64url-encoded SHA-256 thumbprint (digest) of the DER encoding of an X.509 certificate

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_application_key	select	appId, keyId, subdomain		Retrieves a specific application key credential by kid
list_application_keys	select	appId, subdomain		Lists all key credentials for an app
generate_application_key	insert	validityYears, appId, subdomain		Generates a new X.509 certificate for an app key credential > Note: To update an app with the newly generated key credential, use the Replace an Application request with the new credentials.signing.kid value in the request body. You can provide just the signing credential object instead of the entire application credential object.
clone_application_key	exec	targetAid, appId, keyId, subdomain		Clones an X.509 certificate for an application key credential from a source app to a target app. For step-by-step instructions to clone a credential, see Share application key credentials for IdPs across apps. > Note: Sharing certificates isn't a recommended security practice.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
appId	string	Application ID
keyId	string	ID of the Key Credential for the application
subdomain	string	(default: my-org)
targetAid	string	Unique key of the target app
validityYears	integer	Expiry years of the application key credential

SELECT examples

get_application_key

Retrieves a specific application key credential by kid

SELECT
created,
e,
expiresAt,
kid,
kty,
lastUpdated,
n,
use,
x5c,
x5t#S256
FROM okta.apps.keys
WHERE appId = '{{ appId }}' -- required
AND keyId = '{{ keyId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_application_keys

Lists all key credentials for an app

SELECT
created,
e,
expiresAt,
kid,
kty,
lastUpdated,
n,
use,
x5c,
x5t#S256
FROM okta.apps.keys
WHERE appId = '{{ appId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

INSERT examples

generate_application_key

Generates a new X.509 certificate for an app key credential
> Note: To update an app with the newly generated key credential, use the Replace an Application request with the new credentials.signing.kid value in the request body. You can provide just the signing credential object instead of the entire application credential object.

INSERT INTO okta.apps.keys (
validityYears,
appId,
subdomain
)
SELECT 
'{{ validityYears }}',
'{{ appId }}',
'{{ subdomain }}'
RETURNING
created,
e,
expiresAt,
kid,
kty,
lastUpdated,
n,
use,
x5c,
x5t#S256
;

Manifest

# Description fields are for documentation purposes
- name: keys
props:
  - name: validityYears
    value: {{ validityYears }}
    description: Required parameter for the keys resource.
  - name: appId
    value: "{{ appId }}"
    description: Required parameter for the keys resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the keys resource.

Lifecycle Methods

clone_application_key

Clones an X.509 certificate for an application key credential from a source app to a target app.

For step-by-step instructions to clone a credential, see Share application key credentials for IdPs across apps.
> Note: Sharing certificates isn't a recommended security practice.

EXEC okta.apps.keys.clone_application_key 
@targetAid='{{ targetAid }}' --required, 
@appId='{{ appId }}' --required, 
@keyId='{{ keyId }}' --required, 
@subdomain='{{ subdomain }}' --required
;