Listing grants for app using a private key client is failing with invalid session

[timoreize]

Describe the bug?

I'm creating a client with the following values:

okta.WithOrgUrl(tenantOktaDomain),
		okta.WithAuthorizationMode("PrivateKey"),
		okta.WithClientId(tenantApplicationClientID),
		okta.WithScopes(scopes),
		okta.WithPrivateKey(privateKey),

And when I call client.Application.ListScopeConsentGrants(ctx, appID, nil) I receive the Invalid Session error.

When I Create the client with SSWS token:

okta.WithOrgUrl(tenantOktaDomain),
		okta.WithScopes(scopes),
		okta.WithAuthorizationMode("SSWS"),
		okta.WithToken(token),

I get the grants as expected.

What is expected to happen?

Receive a non-error response with the grants for an application

What is the actual behavior?

Receiving an Invalid Session error.

Reproduction Steps?

As mentioned above.

Additional Information?

No response

Golang Version

1.18.3

SDK Version

2.13.0

OS version

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

[github-actions]

This issue has been marked stale because there has been no activity within the last 14 days. To keep this issue active, remove the stale label.

[github-actions]

This issue has been marked stale because there has been no activity within the last 14 days. To keep this issue active, remove the stale label.

[monde]

@timoreize apologies for a slow reply. Did you work through this issue? If you are using an oauth token via privatekey I wonder if that token has the proper scopes assigned to it for a GET /api/v1/apps/{appId}/grants that the SDK is calling in ListScopeConsentGrants. I believe the required scope would be okta.apps.read. https://developer.okta.com/docs/reference/api/apps/#list-scope-consent-grants-for-application