> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/configure-authentik-to-use-rs256.md).
# Configure Authentik to Use RS256
### Overview
For **Authentik 2026.8.0**, configure the OAuth2/OpenID provider associated with the `oe-market-demo` application to use an RSA signing key, authenticated as `akadmin`.
Selecting a signing key configures Authentik to sign JWTs asymmetrically using the private key associated with the selected certificate. The corresponding public key is exposed through the provider's configuration endpoint for [token verification](#verification).
### Procedure
1. Authenticate in Authentik Dashboard as `akadmin` , Administrator account which was created at [initial setup](/infrastructure/user-management-package/deployment-steps/post-installation-steps.md#set-the-authentik-server-administrator-account).
2. Navigate to **Applications → Providers** and search for the OIDC provider associted with the application.
3. Edit the OAuth2/OpenID provider.
3. Expand **Advanced protocol settings** and locate **Signing Key**.
4. Select an **RSA certificate/key pair**. For example, select **`authentik Self-signed Certificate`** if it uses an RSA key.
5. Save the provider configuration.
### Verification
1. Access `.well-known` configuration URL associated with OIDC provider.
2. Check `id_token_signing_alg_values_supported` to be `RS256` .
### Troubleshooting
After applying the configuration, verify the Signer Server authentication flow. If the following error is returned in the browser **DevTools**:
```
{
"statusCode": 401,
"timestamp": "2026-09-22T12:37:22.940Z",
"path": "/api/v1/available-networks",
"message": "Invalid or missing Authentik token"
}
```
Check the signing certificate configured for the Authentik provider:
* If a **custom certificate** is currently selected, switch the **Signing Key** to **`authentik Self-signed Certificate`**, provided it is an RSA certificate, and test the authentication flow again.
* If **`authentik Self-signed Certificate`** is selected and the error persists, try selecting the configured **custom RSA certificate** instead and test again.
The important requirement for Signer Server **v1.0.0** is that the JWT is signed using an **RSA key**, allowing it to be validated using the **RS256** algorithm.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/configure-authentik-to-use-rs256.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
