---
# @generated by sylphx-gen. Do not edit.
title: "Trusted issuers"
description: "The `trusted_issuers` collection of Sylphx Auth: A Trusted Issuer lets the environment's end users sign in with the customer's own identity provider (Clerk, Auth0, Cognito, Firebase Auth, or any OIDC or JWT issuer) instead of Sylphx Auth."
type: reference
product: auth
summary: "A Trusted Issuer lets the environment's end users sign in with the customer's own identity provider (Clerk, Auth0, Cognito, Firebase Auth,…"
updated: 2026-09-28
order: 900
---

A Trusted Issuer lets the environment's end users sign in with the customer's own identity provider (Clerk, Auth0, Cognito, Firebase Auth, or any OIDC or JWT issuer) instead of Sylphx Auth. Every Sylphx service then accepts that issuer's access tokens as the end user `ext_<issuer key>_<hash of iss and sub>`, with role `authenticated`. Auth fetches and caches the issuer's keys; a verifying service never calls the issuer. No profile or password is stored: the issuer owns the user and the session.

**Service** Sylphx Auth · **Resource type** `auth.sylphx.com/TrustedIssuer` · **Name pattern** `orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer}` · **Shape** `record`

## Fields

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | `orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer}`; the final segment is the issuer key (`^[a-z][a-z0-9]{1,15}$`, for example `clerk`) that every end-user id from this issuer carries. It never changes, so a user keeps the same id for as long as the issuer is trusted. |
| `uid` | `string` | `tis_<ulid>`; never reused. Output only. |
| `meta` | `ResourceMeta` | Resource metadata. |
| `issuer` | `string` | The exact `iss` the issuer's tokens carry, an HTTPS URL, for example `https://clerk.example.com` or `https://securetoken.google.com/<project>`. One Trusted Issuer per issuer in an environment. Required. |
| `jwks_uri` | `string` | The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required. |
| `audiences` | `string[]` | A token's `aud` must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required. |
| `app_metadata_claims` | `TrustedIssuerClaimMapping[]` | Token claims copied into the end user's `app_metadata`, the claim policies read (for example the issuer's `org_role` as `roles`). Map only claims the issuer's admin sets, never ones the user can write. |
| `disabled` | `bool` | A disabled issuer's tokens are refused; its users keep their ids and data. |

## Methods

Every method of the collection, in the registry's order, with the scope it
needs. The full request, response and examples are one link away.

| Method | Call | What it does |
| --- | --- | --- |
| `GET` | [`get`](/docs/api/trusted_issuers#get) | Gets an trusted issuer. |
| `GET` | [`list`](/docs/api/trusted_issuers#list) | Lists trusted issuers. |
| `POST` | [`create`](/docs/api/trusted_issuers#create) | Creates an trusted issuer. |
| `PATCH` | [`update`](/docs/api/trusted_issuers#update) | Updates an trusted issuer. |
| `DELETE` | [`delete`](/docs/api/trusted_issuers#delete) | Deletes an trusted issuer. |

## get

Gets an trusted issuer.

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer` · scope `auth:read` · effect `read` · [Request, response and examples](/docs/api/trusted_issuers/get)

## list

Lists trusted issuers.

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers` · scope `auth:read` · effect `read` · paginated · [Request, response and examples](/docs/api/trusted_issuers/list)

## create

Creates an trusted issuer.

`POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers` · scope `auth:write` · effect `write` · [Request, response and examples](/docs/api/trusted_issuers/create)

## update

Updates an trusted issuer.

`PATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer` · scope `auth:write` · effect `write` · [Request, response and examples](/docs/api/trusted_issuers/update)

## delete

Deletes an trusted issuer.

`DELETE https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer` · scope `auth:write` · effect `destructive` · [Request, response and examples](/docs/api/trusted_issuers/delete)