---
title: Trusted issuers
description: Define third-party token issuer resources in PingOne to represent actual external JWT issuers that PingOne should trust.
component: pingone-api
page_id: pingone-api:platform:trusted-issuers/index
canonical_url: https://developer.pingidentity.com/pingone-api/platform/trusted-issuers/index.html
llms_txt: https://developer.pingidentity.com/pingone-api/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-11-01
section_ids:
  trusted-issuers-data-model: Trusted issuers data model
  trusted-issuers-events-generated: Trusted issuers events generated
---

# Trusted issuers

Trusted issuers are third-party token issuer resources in PingOne that represent actual external JWT issuers that PingOne should trust. By specifying trusted issuers, the PingOne authorization server will accept third-party signed JWTs (as subject or actor tokens in a token exchange action) from the trusted issuer.

After you define trusted issuers, you can assign them to applications that are configured to use the token exchange grant type (`urn:ietf:params:oauth:grant-type:token-exchange`), using third-party signed JWTs as token-exchange inputs. In these cases, the `subject_token_type` and `actor_token_typ` parameter values in the token request must be set to `urn:ietf:params:oauth:token-type:jwt`.

|   |                                                                                                                                                                                                                                                                            |
| - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | To learn more about token exchange, refer to [Use a trusted issuer JWT for token enrichment](../../auth/auth-config-options/token-enrichment.html) and [Internet Engineering Task Force RFC 8693 OAuth 2.0 Token Exchange](https://datatracker.ietf.org/doc/html/rfc8693). |

## Trusted issuers data model

| Property            | Type    | Required          | Mutable   | Description                                                                                                                                                                                                                     |
| ------------------- | ------- | ----------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `audiences[]`       | Array   | Optional          | Mutable   | An array of audience values. If specified, at least one audience in the incoming token's `aud` array must match one of the defined audiences. If not set, the incoming JWT `aud` claim is ignored.                              |
| `clockSkew`         | Integer | Optional          | Mutable   | A value in seconds that compensates for small time synchronization discrepancies between different entities to protect against failed validation because of clock differences. The minimum value is 0; the maximum value is 60. |
| `createdAt`         | Date    | N/A               | Read-only | The time the resource was created.                                                                                                                                                                                              |
| `description`       | String  | Optional          | Mutable   | A description of the trusted issuer.                                                                                                                                                                                            |
| `environment.id`    | String  | N/A               | Immutable | The identifier of the environment resource referenced by this relationship.                                                                                                                                                     |
| `expRequired`       | Boolean | Optional          | Mutable   | Indicates whether the `exp` (Expiration Time) token claim is required. The default value is `true`.                                                                                                                             |
| `iatRequired`       | Boolean | Optional          | Mutable   | Indicates whether the `iat` (Issued At Time) token claim is required. The default value is `false`.                                                                                                                             |
| `id`                | String  | N/A               | Immutable | The attribute's unique identifier.                                                                                                                                                                                              |
| `issuer`            | String  | Required          | Mutable   | A URL (supports `https://` only) that identifies the trusted issuer.                                                                                                                                                            |
| `jwks`              | String  | Required/Optional | Mutable   | A JWKS string that validates the signature of signed JWTs. This property is set in configurations where the `jwksurl` option is not set.                                                                                        |
| `jwksUrl`           | String  | Required/Optional | Mutable   | A URL (supports `https://` only) that provides access to a JWKS string that validates the signature of signed JWTs. This property is set in configurations where the `jwks` option is not set.                                  |
| `maxFutureValidity` | Integer | Optional          | Mutable   | Configures the token's maximum amount of time (in seconds) on how far in the future the `exp` (Expiration Time) claim can be set. The minimum value is 0; the maximum value is 30 days.                                         |
| `name`              | String  | Required          | Mutable   | The name of the trusted issuer.                                                                                                                                                                                                 |
| `nbfRequired`       | Boolean | Optional          | Mutable   | Indicates whether the `nbf` (Not Before Time) token claim is required. The default value is `false`.                                                                                                                            |
| `updatedAt`         | Date    | N/A               | Read-only | The time the resource was last updated.                                                                                                                                                                                         |

## Trusted issuers events generated

Refer to [Audit Reporting Events](../reference/audit-reporting-events.html) for the events generated.