# How to generate a client assertion signing key for a native app to sign in with PKCE? **URL:** \ **Category:** Get Help\ **Tags:** sdks-quickstarts, auth0js\ **Created:** [August 26, 2025, 3:31pm UTC](https://community.auth0.com/t/how-to-generate-a-client-assertion-signing-key-for-a-native-app-to-sign-in-with-pkce/191128 "2025-08-26T15:31:10Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jessetg](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jessetg/32/72251_2.png) [@jessetg](https://community.auth0.com/u/jessetg)\ **Post date:** [August 26, 2025, 3:31pm UTC](https://community.auth0.com/t/how-to-generate-a-client-assertion-signing-key-for-a-native-app-to-sign-in-with-pkce/191128/1 "2025-08-26T15:31:10Z")
I’m working on a native app with a backend component (both in node.js), and I’m trying to authenticate the native app securely. Since the native app will be publicly distributed, I want to authenticate with the Authorization Code Flow with PKCE. I’m trying to use the `@auth0/auth0-auth-js` package for that, but `AuthClient.buildAuthorizationUrl` raises a `MissingClientAuthError`, telling me that `the client secret or client assertion signing key must be provided`. The code I’m working on will be running natively, so the client-secret is a no-go. That leaves a client assertion signing key. However, I couldn’t find any guidance from Auth0 on creating one (and keeping it secure); _how can I create a client assertion signing key for use with `@auth0/auth0-auth-js`_ , and _how should I handle it responsibly_? ---
**Author:** ![jessetg](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jessetg/32/72251_2.png) [@jessetg](https://community.auth0.com/u/jessetg)\ **Post date:** [August 27, 2025, 7:40pm UTC](https://community.auth0.com/t/how-to-generate-a-client-assertion-signing-key-for-a-native-app-to-sign-in-with-pkce/191128/3 "2025-08-27T19:40:31Z")
Ah, apparently this is described in the docs [here](https://auth0.com/docs/secure/application-credentials/generate-rsa-key-pair). That said, this might not even be the best approach for my needs. However, opining on that is beyond the scope of this post. ---
**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\ **Post date:** [August 27, 2025, 8:05pm UTC](https://community.auth0.com/t/how-to-generate-a-client-assertion-signing-key-for-a-native-app-to-sign-in-with-pkce/191128/4 "2025-08-27T20:05:05Z")
Hi @jessetg Welcome to the Auth0 Community! Reading through your use-case, I would recommend looking through the following documentation [Authenticate with Private Key JWT](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt) for more details on how to build the assertion for the desired flow. I believe you should be able to complete this using the `@auth0/auth0-auth-js` package. The following documentation on [Signing Keys](https://auth0.com/docs/get-started/tenant-settings/signing-keys) can also be useful on the matter of JWT private keys. Hope this helps! Gerald ---
**Author:** ![jessetg](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jessetg/32/72251_2.png) [@jessetg](https://community.auth0.com/u/jessetg)\ **Post date:** [August 27, 2025, 8:21pm UTC](https://community.auth0.com/t/how-to-generate-a-client-assertion-signing-key-for-a-native-app-to-sign-in-with-pkce/191128/5 "2025-08-27T20:21:04Z")
Thank you, I appreciate the response. Unfortunately, it looks like Private Key JWT support is only available on the Enterprise plan; that’s actually what led me to reconsider whether it’s really the method I need. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [September 10, 2025, 8:21pm UTC](https://community.auth0.com/t/how-to-generate-a-client-assertion-signing-key-for-a-native-app-to-sign-in-with-pkce/191128/6 "2025-09-10T20:21:37Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.