This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::BedrockAgentCore::OAuth2CredentialProvider PrivateKeyJwtConfig
<a name="aws-properties-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig"></a>

The private key configuration for private\_key\_jwt client authentication.

## Syntax
<a name="aws-properties-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-syntax.json"></a>

```
{
  "[AdditionalHeaderClaims](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-additionalheaderclaims)" : {{{{{Key}}: {{Value}}, ...}}},
  "[AdditionalPayloadClaims](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-additionalpayloadclaims)" : {{{{{Key}}: {{Value}}, ...}}},
  "[PrivateKeySource](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-privatekeysource)" : {{PrivateKeySource}},
  "[SigningAlgorithm](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-signingalgorithm)" : {{String}}
}
```

### YAML
<a name="aws-properties-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-syntax.yaml"></a>

```
  [AdditionalHeaderClaims](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-additionalheaderclaims): {{
    {{Key}}: {{Value}}}}
  [AdditionalPayloadClaims](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-additionalpayloadclaims): {{
    {{Key}}: {{Value}}}}
  [PrivateKeySource](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-privatekeysource): {{
    PrivateKeySource}}
  [SigningAlgorithm](#cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-signingalgorithm): {{String}}
```

## Properties
<a name="aws-properties-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-properties"></a>

`AdditionalHeaderClaims`  <a name="cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-additionalheaderclaims"></a>
A map of additional claims to include in the JWT client assertion header. Standard header claims such as `alg` and `typ` cannot be added.  
*Required*: No  
*Type*: Object of String  
*Pattern*: `^[A-Za-z0-9_.:#-]+$`  
*Minimum*: `1`  
*Maximum*: `2048`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`AdditionalPayloadClaims`  <a name="cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-additionalpayloadclaims"></a>
A map of additional claims to include in the JWT client assertion payload. Payload claims generated by the service, such as `iss`, `sub`, `jti`, and `exp`, cannot be added.  
*Required*: No  
*Type*: Object of String  
*Pattern*: `^[A-Za-z0-9_.:#-]+$`  
*Minimum*: `1`  
*Maximum*: `2048`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PrivateKeySource`  <a name="cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-privatekeysource"></a>
The private key source for the JWT client assertion.  
*Required*: No  
*Type*: [PrivateKeySource](aws-properties-bedrockagentcore-oauth2credentialprovider-privatekeysource.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SigningAlgorithm`  <a name="cfn-bedrockagentcore-oauth2credentialprovider-privatekeyjwtconfig-signingalgorithm"></a>
The algorithm used to sign the JWT client assertion. Valid values are `RS256`, `PS256`, and `ES256`.  
*Required*: No  
*Type*: String  
*Allowed values*: `RS256 | PS256 | ES256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)