---
title: "Create a new auth server"
method: POST
path: "/v1/auth-servers"
tags: ["Auth Server"]
---

# Create a new auth server

`POST /v1/auth-servers`

Create a new auth server. Each auth server has a unique, randomly generated, public issuer URL.

## Request body

- object
  - `name` string, required — The name of the auth server
  - `description` string — The description of the auth server
  - `audience` string, required — The recipients that the tokens are intended for. This becomes the 'aud' claim in an access token
  - `signing_algorithm` 'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512' — Algorithm used in the key signing process
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `trusted_origins` TrustedOrigin[] — A list or trusted origins to apply the CORS header on for the auth server
  - `dcr_default_access_token_duration` integer — The default access token duration, in seconds, applied to DCR clients registered against this auth server

## Response `201`

An auth server

- AuthServer
  - `id` string, uuid, required — The ID of the auth server
  - `name` string, required — The name of the auth server
  - `description` string, required — The description of the auth server
  - `audience` string, required — The recipients that the tokens are intended for. This becomes the 'aud' claim in an access token
  - `signing_algorithm` 'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512', required — Algorithm used in the key signing process
  - `issuer` string, required — The complete URL for the custom authorization server. This becomes the 'iss' claim in an access token.
  - `metadata_uri` string, uri, required — The URI of the metadata document for the auth server
  - `jwks_uri` string, uri — The URI of the JWKS endpoint for the auth server
  - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
  - `trusted_origins` TrustedOrigin[] — A list or trusted origins to apply the CORS header on for the auth server
  - `dcr_default_access_token_duration` integer — The default access token duration, in seconds, applied to DCR clients registered against this auth server

## Other responses

- `400` — Bad Request
- `409` — Conflict

## Changes

- **2026-08-18** `658ffb748f95` — 1 info
  - added the optional property `jwks_uri` to the response with the `201` status
- **2026-03-27** `2322191a98f7` — 2 info
  - added the new optional request property `dcr_default_access_token_duration`
  - added the optional property `dcr_default_access_token_duration` to the response with the `201` status
- **2025-11-26** `3575228c4a98` — 2 info
  - added the new optional request property `trusted_origins`
  - added the optional property `trusted_origins` to the response with the `201` status
- **2025-11-06** `5d2b35832e3f` — 1 warning
  - added the new `type` enum value to the `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
- …earlier changes not shown

[Full history](https://skmtc.dev/kong/apis/konnect-api-beta/changes/v1/auth-servers/post.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api-beta.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api-beta/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kong/konnect-api-beta/revisions/658ffb748f95/schema)