---
title: "Register trusted token issuer"
method: POST
path: "/v2/trusted_token_issuers"
tags: ["Trusted Token Issuers"]
---

# Register trusted token issuer

`POST /v2/trusted_token_issuers`

Registers a customer identity provider as a trusted issuer of end-user sign-in tokens.
A widget connector references the registration by id to accept tokens the issuer signs.

## Headers

- `Request-Timeout` integer
- `Request-Timeout-Millis` integer

## Request body

- CreateTrustedTokenIssuerRequest — Request object for registering a trusted token issuer.
  - `name` string, required — The human-readable name of the trusted issuer.
  - `description` string — A detailed description of what this trust registration is for.
  - `issuer` string, required — The issuer URL exactly as it appears in the `iss` claim of the identity provider's tokens. Immutable after creation. A customer may register an issuer once; a duplicate registration returns `409`.
  - `jwks_uri` string, required — The HTTPS URL of the issuer's JSON Web Key Set.
  - `enabled` boolean — Whether the registration accepts tokens upon creation.

## Response `201`

The newly registered trusted token issuer.

- TrustedTokenIssuer — A customer identity provider whose signed tokens the platform accepts as end-user credentials. The registration is a trust anchor: the issuer URL and the JWKS the platform verifies signatures against. What a verified token grants is declared on the widget connector that references this registration by id.
  - `id` string, required — The unique identifier of a trusted token issuer.
  - `name` string, required — The human-readable name of the trusted issuer.
  - `description` string — A detailed description of what this trust registration is for.
  - `issuer` string, required — The issuer URL exactly as it appears in the `iss` claim of the identity provider's tokens. Immutable after creation. A customer may register an issuer once; a duplicate registration returns `409`.
  - `jwks_uri` string, required — The HTTPS URL of the issuer's JSON Web Key Set. The platform fetches it server-side and refreshes it periodically, so new signing keys become effective on the next refresh. A token signed with a key the platform has not yet seen triggers one immediate refresh. When a refresh fails, previously fetched keys remain in use until a refresh succeeds.
  - `enabled` boolean, required — Whether the registration currently accepts tokens. Disabling refuses every future sign-in immediately.
  - `last_jwks_fetch_at` string, date-time — Timestamp of the most recent successful fetch of the issuer's JWKS. Absent until the first successful fetch.
  - `jwks_key_count` integer — The number of signing keys in the most recent successful JWKS fetch.
  - `jwks_fetch_error` string — The most recent JWKS fetch error, absent while fetching is healthy.
  - `created_at` string, date-time, required — Timestamp when the registration was created.
  - `updated_at` string, date-time — Timestamp when the registration was last updated.

## Other responses

- `400` — The request is malformed, or `issuer` or `jwks_uri` is not an https URL.
- `403` — Permissions do not allow registering trusted token issuers.
- `409` — A registration for this issuer already exists.

## Changes

- **2026-08-27** `0d51a9e3a0b3` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/vectara/apis/vectara-rest-api-v2/changes/v2/trusted_token_issuers/post.md)

---

[API](https://skmtc.dev/vectara/apis/vectara-rest-api-v2.md) · [All operations](https://skmtc.dev/vectara/apis/vectara-rest-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/vectara/vectara-rest-api-v2/revisions/05ae305c8d84/schema)