---
# @generated by sylphx-gen. Do not edit.
title: "sylphx auth trusted_issuers"
description: "The sylphx auth trusted_issuers commands of Sylphx Auth: every verb, with its argument, its flags and a run line."
type: reference
product: auth
summary: "Every sylphx auth trusted_issuers command: its argument, its flags and a run line."
updated: 2026-09-28
nav: false
---

The `trusted_issuers` commands of Sylphx Auth, as the CLI spells them: the same
calls as [the `trusted_issuers` API page](/docs/api/trusted_issuers), typed for the
shell. [Install, sign in and the grammar](/docs/cli) are on the CLI index.

## get

Gets an trusted issuer.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx auth trusted-issuers get orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer
```

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer` · scope `auth:read` · effect `read` · [Request, response and examples](/docs/api/trusted_issuers/get)

## list

Lists trusted issuers.

**`PARENT`** — optional: the CLI fills it from the linked project or the
key's scope when it is left out.

**CLI**

```bash
sylphx auth trusted-issuers list orgs/acme/projects/shop/envs/production
```

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers` · scope `auth:read` · effect `read` · [Request, response and examples](/docs/api/trusted_issuers/list)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--page-size` | `int` | At most this many; default 50, clamped to 1000. |
| `--page-token` | `string` | `next_page_token` of the previous page. |
| `--filter` | `string` | AIP-160 filter over labels and filterable fields. |
| `--order-by` | `string` | AIP-132 ordering over filterable fields. |

## create

Creates an trusted issuer.

**`ID`** — The id segment of the new Resource's name; the server assigns one when omitted.

**CLI**

```bash
sylphx auth trusted-issuers create --parent orgs/acme/projects/shop/envs/production --issuer … --jwks-uri …
```

`POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers` · scope `auth:write` · effect `write` · [Request, response and examples](/docs/api/trusted_issuers/create)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--parent` | `string` | The parent to create in; defaults to the linked project or the key's scope. |
| `--meta.labels` | `key=value` | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
| `--meta.annotations` | `key=value` | Caller-writable, unindexed annotations. Repeat the flag for each value. |
| `--meta.display-name` | `string` | Caller-writable human-readable name. |
| `--issuer` | `string` | The exact `iss` the issuer's tokens carry, an HTTPS URL, for example `https://clerk.example.com` or `https://securetoken.google.com/<project>`. One Trusted Issuer per issuer in an environment. Required. |
| `--jwks-uri` | `string` | The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required. |
| `--audiences` | `string` | A token's `aud` must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required. Repeat the flag for each value. |
| `--app-metadata-claims` | `json` | Token claims copied into the end user's `app_metadata`, the claim policies read (for example the issuer's `org_role` as `roles`). Map only claims the issuer's admin sets, never ones the user can write. Repeat the flag for each value. |
| `--disabled` | `bool` | A disabled issuer's tokens are refused; its users keep their ids and data. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |

## update

Updates an trusted issuer.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx auth trusted-issuers update orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer --jwks-uri …
```

`PATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer` · scope `auth:write` · effect `write` · [Request, response and examples](/docs/api/trusted_issuers/update)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--meta.labels` | `key=value` | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
| `--meta.annotations` | `key=value` | Caller-writable, unindexed annotations. Repeat the flag for each value. |
| `--meta.display-name` | `string` | Caller-writable human-readable name. |
| `--jwks-uri` | `string` | The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required. |
| `--audiences` | `string` | A token's `aud` must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required. Repeat the flag for each value. |
| `--app-metadata-claims` | `json` | Token claims copied into the end user's `app_metadata`, the claim policies read (for example the issuer's `org_role` as `roles`). Map only claims the issuer's admin sets, never ones the user can write. Repeat the flag for each value. |
| `--disabled` | `bool` | A disabled issuer's tokens are refused; its users keep their ids and data. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |

## delete

Deletes an trusted issuer.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx auth trusted-issuers delete orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer --yes
```

`DELETE https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer` · scope `auth:write` · effect `destructive` · [Request, response and examples](/docs/api/trusted_issuers/delete)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--etag` | `string` | Delete only if the current etag matches. |
| `--allow-missing` | `bool` | Succeed when the trusted issuer does not exist. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |
| `--yes` | `bool` | Do not ask before this destructive call. |