Sign in
Trusted Token Issuers

Register trusted token issuer

Registers a customer identity provider as a trusted issuer of end-user sign-in tokens. A widget connector references the registration by id to accept tokens the issuer signs.

post/v2/trusted_token_issuers

Headers

Request-Timeoutinteger

The platform makes a best effort to complete the request in the specified seconds, or it times out.

Request-Timeout-Millisinteger

The platform makes a best effort to complete the request in the specified milliseconds, or it times out.

Request body

namestring required

The human-readable name of the trusted issuer.

descriptionstring

A detailed description of what this trust registration is for.

issuerstring required

The issuer URL exactly as it appears in the iss claim of the identity provider's tokens. Immutable after creation. A customer may register an issuer once; a duplicate registration returns 409.

jwks_uristring required

The HTTPS URL of the issuer's JSON Web Key Set.

enabledboolean

Whether the registration accepts tokens upon creation.

Example request

{
  "name": "Acme Okta production",
  "description": "Lets Acme portal users chat with the support agent.",
  "issuer": "https://acme.okta.com/oauth2/default",
  "jwks_uri": "https://acme.okta.com/oauth2/default/v1/keys",
  "enabled": true
}

Response

The newly registered trusted token issuer.

idstring required

The unique identifier of a trusted token issuer.

namestring required

The human-readable name of the trusted issuer.

descriptionstring

A detailed description of what this trust registration is for.

issuerstring required

The issuer URL exactly as it appears in the iss claim of the identity provider's tokens. Immutable after creation. A customer may register an issuer once; a duplicate registration returns 409.

jwks_uristring required

The HTTPS URL of the issuer's JSON Web Key Set. The platform fetches it server-side and refreshes it periodically, so new signing keys become effective on the next refresh. A token signed with a key the platform has not yet seen triggers one immediate refresh. When a refresh fails, previously fetched keys remain in use until a refresh succeeds.

enabledboolean required

Whether the registration currently accepts tokens. Disabling refuses every future sign-in immediately.

last_jwks_fetch_atstring date-time

Timestamp of the most recent successful fetch of the issuer's JWKS. Absent until the first successful fetch.

jwks_key_countinteger

The number of signing keys in the most recent successful JWKS fetch.

jwks_fetch_errorstring

The most recent JWKS fetch error, absent while fetching is healthy.

created_atstring date-time required

Timestamp when the registration was created.

updated_atstring date-time

Timestamp when the registration was last updated.

Example response

{
  "id": "tki_9Kx2QpVn4mZr8YbLc5TdWe",
  "name": "Acme Okta production",
  "description": "Lets Acme portal users chat with the support agent.",
  "issuer": "https://acme.okta.com/oauth2/default",
  "jwks_uri": "https://acme.okta.com/oauth2/default/v1/keys",
  "enabled": true,
  "last_jwks_fetch_at": "2026-08-12T10:30:00Z",
  "jwks_key_count": 2,
  "jwks_fetch_error": "jwks fetch failed: connection timed out",
  "created_at": "2026-08-07T10:30:00Z",
  "updated_at": "2026-08-07T14:45:00Z"
}

Changes

Changed in 1 of the 7 revisions of this API.1