Trusted issuer
The identity provider whose tokens this environment will accept.
An issuer is the identity provider that signs the assertions your backend sends. Registering one tells a single environment to trust tokens carrying that exact issuer value, verified against a fixed JWKS URL.
What is accepted
- Public HTTPS hostnames only.
- RS256 signatures.
- The issuer URL must match the token’s iss claim exactly.
- Assertions must live 60 seconds or less, and each one may be used once.
Tenant mapping
An issuer asserts a tenant in its own vocabulary. A mapping translates that value into one of your bound tenants, so your customer ids and your identity provider’s do not have to agree.
token.iss → registered issuer (must be active)
token.<tenant> → issuer mapping → your host tenant
→ tenant must be bound and active in this environment
token.sub → end user (found, or created now)