AWS and Keyfactor release X.509 PKI-based AI agent identity authentication reference architecture

The architecture has three authentication layers. At the user-to-system layer, users log in to Keycloak via OAuth 2.0 and perform an RFC 8693 token exchange to obtain a downscoped token restricted to the MCP server audience; private keys are generated locally and stored as PKCS12 in AWS Secrets Manager. At the inter-agent layer, requests are signed with RSA-PSS-SHA256 over the payload, timestamp, and random nonce, and the receiver performs six checks: signature, freshness (60 seconds by default), nonce deduplication, CA chain, role, and OCSP. At the MCP tool server layer, token introspection, envelope verification, and user delegation assertion validation are performed. Amazon Bedrock provides inference, the database runs on Amazon RDS for MySQL, email goes through Amazon SES, and Keycloak and EJBCA are deployed on Amazon EC2. Developers building multi-agent systems with the AWS Strands Agents SDK and connecting them to MCP tool servers can adopt this pattern directly to prevent component impersonation, credential replay, and unauthorized tool calls; teams managing enterprise agent deployments can also use real-time OCSP to make certificate revocation take effect immediately across all agents. The original article requires Keycloak 26.2 or later for standard token exchange; older exchange methods are incompatible.