2021-08-01 14:27:44 -07:00
---
description: This is a guide to create ingestion bot service app.
---
# Create Service Account
## Step 1: Generate Public/Private key pair
2021-11-13 23:03:20 +05:30
* Use a tool such as this JSON [Web Key Generator ](https://mkjwk.org ) to generate a JWKS public/private key pair for testing.
2021-08-01 14:27:44 -07:00
* For a production use case, use your own [internal instance ](https://github.com/mitreid-connect/mkjwk.org ) of the key pair generator.
* For production use case, clone the repository using `git clone https://github.com/mitreid-connect/mkjwk.org.git` .
* Use `mvn package -DskipTests && java -jar target/ROOT.war` to run the above repo.
2021-11-13 23:03:20 +05:30
* Go to `http:localhost:8080` to generate **public/private key pairs** .
2021-08-01 14:27:44 -07:00
2021-08-16 16:52:35 +00:00
* Enter the following values to generate a **public/private key pair** :
2021-08-01 14:27:44 -07:00
* Key size - 2048
* Key use — signature
* Algorithm — RSA256
2021-11-13 23:03:20 +05:30
* Key ID — (Optional) This can be any random value.
2021-08-01 14:27:44 -07:00
2021-08-16 16:52:35 +00:00
* Once you provide the input, click **Generate** . You will get the **Public/Private Keypair** , **Public/Private Keypair Set,** and **Public Key**
2021-08-01 14:27:44 -07:00
## Step 2: Create Service-App
* You will need to make a **POST** request to `https://${yourOktaDomain}/oauth2/v1/clients` endpoint to create a service app in okta
* The parameters involved in the request are:
2021-11-13 23:03:20 +05:30
* **client_name** - the name of the service app
* **grant_type** - **client_credentials**
* **token_endpoint_auth_method** — **private_key_jwt**
* **application_type** — **service**
2021-08-01 14:27:44 -07:00
* **jwks** — add the **Public/Private Keypair Set** that you created in the previous step.
* The request looks something like this:
* To check if the service app is created navigate to your **Okta Dashboard** .
2021-11-13 23:03:20 +05:30
* Click on **Applications -> Applications** on the left side.
2021-08-01 14:27:44 -07:00
* You should see your service account in the list.
## Step 3: Grant allowed scopes
* To add a grant for an allowed scope to your service app, we need to make a **POST** request to `https://${yourOktaDomain}/api/v1/apps/{serviceappclient_id}/grants` endpoint.
* The parameters involved in the request are:
* **scopeID** — **okta.clients.manage**
* The request looks something like this:
2021-11-13 23:03:20 +05:30
* You can also add scopes by navigating to your **Okta Dashboard** and Clicking on **Applications -> Applications** just like in step 2.
2021-08-01 14:27:44 -07:00
* Click on your service app.
* Now click on Okta API Scopes available on the top of the form.
* Grant the scopes by clicking on **Grant** .
* To get more info on the scopes. Visit the [Doc ](https://developer.okta.com/docs/guides/implement-oauth-for-okta/scopes/ )
