Reference

Trusted issuers

A Trusted Issuer lets the environment's end users sign in with the customer's own identity provider (Clerk, Auth0, Cognito, Firebase Auth,…

Checked 2026-09-28

A Trusted Issuer lets the environment's end users sign in with the customer's own identity provider (Clerk, Auth0, Cognito, Firebase Auth, or any OIDC or JWT issuer) instead of Sylphx Auth. Every Sylphx service then accepts that issuer's access tokens as the end user ext_<issuer key>_<hash of iss and sub>, with role authenticated. Auth fetches and caches the issuer's keys; a verifying service never calls the issuer. No profile or password is stored: the issuer owns the user and the session.

Service Sylphx Auth · Resource type auth.sylphx.com/TrustedIssuer · Name pattern orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer} · Shape record

#Fields

Field	Type	What it is
name	string	orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer}; the final segment is the issuer key (^[a-z][a-z0-9]{1,15}$, for example clerk) that every end-user id from this issuer carries. It never changes, so a user keeps the same id for as long as the issuer is trusted.
uid	string	tis_<ulid>; never reused. Output only.
meta	ResourceMeta	Resource metadata.
issuer	string	The exact iss the issuer's tokens carry, an HTTPS URL, for example https://clerk.example.com or https://securetoken.google.com/<project>. One Trusted Issuer per issuer in an environment. Required.
jwks_uri	string	The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required.
audiences	string[]	A token's aud must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required.
app_metadata_claims	TrustedIssuerClaimMapping[]	Token claims copied into the end user's app_metadata, the claim policies read (for example the issuer's org_role as roles). Map only claims the issuer's admin sets, never ones the user can write.
disabled	bool	A disabled issuer's tokens are refused; its users keep their ids and data.

#Methods

Every method of the collection, in the registry's order, with the scope it needs. The full request, response and examples are one link away.

Method	Call	What it does
GET	get	Gets an trusted issuer.
GET	list	Lists trusted issuers.
POST	create	Creates an trusted issuer.
PATCH	update	Updates an trusted issuer.
DELETE	delete	Deletes an trusted issuer.

#get

Gets an trusted issuer.

GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer · scope auth:read · effect read · Request, response and examples

#list

Lists trusted issuers.

GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers · scope auth:read · effect read · paginated · Request, response and examples

#create

Creates an trusted issuer.

POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers · scope auth:write · effect write · Request, response and examples

#update

Updates an trusted issuer.

PATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer · scope auth:write · effect write · Request, response and examples

#delete

Deletes an trusted issuer.

DELETE https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer · scope auth:write · effect destructive · Request, response and examples