Obtain a scoped Okta Management API access token using OAuth 2.0 client_credentials with private_key_jwt from an API Services app

Documented steps

1. In the Okta Admin Console go to Applications > Applications > Create App Integration and choose 'API Services' as the sign-in method; the client_credentials grant is selected automatically.
2. Open the app's Admin roles tab, click Edit assignments, and assign the least-privilege admin role that covers the resources you intend to touch. Scope grants alone do NOT widen access beyond this role.
3. On the General tab under Client Credentials, choose 'Public key/Private key' as the client authentication method, select 'Save keys in Okta', then Add key > Generate new key. Supported algorithms: RS256, RS384, RS512, ES256, ES384, ES512. Copy the private key immediately - it is displayed only once.
4. On the Okta API Scopes tab, click Grant for every scope the integration needs (for example okta.users.read, okta.users.manage, okta.groups.manage). The equivalent API call is POST /api/v1/apps/{appId}/grants.
5. Build a JWT client assertion signed with the private key containing: aud = https://{yourOktaDomain}/oauth2/v1/token, iss = {client_id}, sub = {client_id}, jti (unique), iat, and exp no more than 1 hour in the future.
6. POST https://{yourOktaDomain}/oauth2/v1/token with headers Accept: application/json and Content-Type: application/x-www-form-urlencoded and form body: grant_type=client_credentials, scope={space-delimited granted scopes}, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, client_assertion={signed_jwt}.
7. Parse the JSON response: access_token, token_type ('Bearer'), expires_in (3600), scope.
8. Call the Management API with header Authorization: Bearer {access_token}, for example GET https://{yourOktaDomain}/api/v1/users?limit=200.
9. On 401 or 403, check BOTH that the requested scope is granted on the Okta API Scopes tab AND that the assigned admin role covers the target resource - both are required.
10. Re-request a token before each batch of work: the client_credentials response contains no refresh_token and the access token expires in exactly 3600 seconds. Cache the token in memory for its lifetime rather than minting one per API call.
11. Official docs consulted: https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/ | https://developer.okta.com/docs/guides/set-up-oauth-api/main/ | https://developer.okta.com/docs/api/oauth2/ | https://developer.okta.com/docs/reference/core-okta-api/