Menu
Platform
AI
Analytics
App store purchases
Credits
Database
Flags
Generated Assets
Monitoring
Notifications
Organizations
Payments
- Payments
- Payments quickstart
- Checkout policies
- Checkout sessions
- Customer subscriptions
- Entitlement grants
- Exchange rates
- Licence keys
- Licence tokens
- Merchant accounts
- Portal sessions
- Price catalogs
- Revenue
- Revenue facts
- Revenue sources
- Tax threshold statuses
- Usage events
- Usage invoices
- Usage meter prices
- Usage meters
- Usage reservations
- Usage settings
- Usage tiers
Queues
Realtime
Sandboxes
Webhooks
Getting Started
Authentication
KV Store
Deploy & Infrastructure
Reference
Create a trusted issuer
Creates an trusted issuer.
Creates an trusted issuer.
- Path
POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers - Scope
auth:write - Effect
write— a successful call changes state. - Collection trusted_issuers
- Query
trusted_issuer_id,validate_only
#Request
| Field | Type | What it is |
|---|---|---|
parent | string | The parent to create in. Required. |
trusted_issuer_id | string | The issuer key, the final name segment (^[a-z][a-z0-9]{1,15}$); it is part of every end-user id from this issuer and never changes. Required. |
trusted_issuer | TrustedIssuer | The trusted issuer to create; only caller-writable fields are read. Required. |
validate_only | bool | Validate and return the result without writing anything. |
#TrustedIssuer
| Field | Type | What it is |
|---|---|---|
name | string | orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer}; the final segment is the issuer key (^[a-z][a-z0-9]{1,15}$, for example clerk) that every end-user id from this issuer carries. It never changes, so a user keeps the same id for as long as the issuer is trusted. |
meta | ResourceMeta | Resource metadata. |
issuer | string | The exact iss the issuer's tokens carry, an HTTPS URL, for example https://clerk.example.com or https://securetoken.google.com/<project>. One Trusted Issuer per issuer in an environment. Required. |
jwks_uri | string | The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required. |
audiences | string[] | A token's aud must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required. |
app_metadata_claims | TrustedIssuerClaimMapping[] | Token claims copied into the end user's app_metadata, the claim policies read (for example the issuer's org_role as roles). Map only claims the issuer's admin sets, never ones the user can write. |
disabled | bool | A disabled issuer's tokens are refused; its users keep their ids and data. |
#ResourceMeta
| Field | Type | What it is |
|---|---|---|
labels | map<string, string> | Caller-writable, indexed labels (AIP-122 label rules). |
annotations | map<string, string> | Caller-writable, unindexed annotations. |
display_name | string | Caller-writable human-readable name. |
#TrustedIssuerClaimMapping
| Field | Type | What it is |
|---|---|---|
claim | string | The top-level claim name in the issuer's token, for example org_role or https://example.com/roles. Required. |
key | string | The app_metadata key it is copied to; unique within the issuer. Required. |
#Response
| Field | Type | What it is |
|---|---|---|
name | string | orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer}; the final segment is the issuer key (^[a-z][a-z0-9]{1,15}$, for example clerk) that every end-user id from this issuer carries. It never changes, so a user keeps the same id for as long as the issuer is trusted. |
uid | string | tis_<ulid>; never reused. Output only. |
meta | ResourceMeta | Resource metadata. |
issuer | string | The exact iss the issuer's tokens carry, an HTTPS URL, for example https://clerk.example.com or https://securetoken.google.com/<project>. One Trusted Issuer per issuer in an environment. Required. |
jwks_uri | string | The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required. |
audiences | string[] | A token's aud must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required. |
app_metadata_claims | TrustedIssuerClaimMapping[] | Token claims copied into the end user's app_metadata, the claim policies read (for example the issuer's org_role as roles). Map only claims the issuer's admin sets, never ones the user can write. |
disabled | bool | A disabled issuer's tokens are refused; its users keep their ids and data. |
#ResourceMeta
| Field | Type | What it is |
|---|---|---|
generation | int64 | Increases by one on every change to spec. Output only. |
etag | string | Strong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as If-Match or etag to make Update and Delete conditional; a mismatch fails with ABORTED / 409 ETAG_MISMATCH. Output only. |
create_time | timestamp | When the Resource was created. Output only. |
update_time | timestamp | When the Resource last changed. Output only. |
delete_time | timestamp | Set while the Resource is being deleted. Output only. |
labels | map<string, string> | Caller-writable, indexed labels (AIP-122 label rules). |
annotations | map<string, string> | Caller-writable, unindexed annotations. |
display_name | string | Caller-writable human-readable name. |
creator | string | The principal that created the Resource. Output only. |
#TrustedIssuerClaimMapping
| Field | Type | What it is |
|---|---|---|
claim | string | The top-level claim name in the issuer's token, for example org_role or https://example.com/roles. Required. |
key | string | The app_metadata key it is copied to; unique within the issuer. Required. |
#Errors
UNAUTHENTICATED— No valid key or token was presented.PERMISSION_DENIED— The key lacks the method's permission.UNKNOWN_FIELD— The request has a field the schema does not know.INVALID_FIELD— A field failed validation.RESOURCE_ALREADY_EXISTS— A Resource with this name exists.IDEMPOTENCY_KEY_REUSED— An Idempotency-Key was reused with another body.IDEMPOTENCY_IN_PROGRESS— The first call with this Idempotency-Key is still running.PLAN_LIMIT_REACHED— The plan's limit is reached.
Every error arrives in the body Errors describes.
#Examples
curl -X POST "https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers" \
-H "Authorization: Bearer $SYLPHX_API_KEY" \
-H "Content-Type: application/json" \
-d '{"audiences":["…"],"issuer":"…","jwks_uri":"…"}'