What is a trusted issuer?
A trusted issuer is an identity provider that a system has been explicitly configured to accept tokens from — identified by its issuer name, its audience, and the keys it signs with.
Registration is the whole point. A system that accepts any validly signed token accepts tokens from anyone who can generate a keypair. Trust has to be granted deliberately and be revocable.
The registration typically pins more than the key: the issuer string, the expected audience and the permitted algorithm, so a token that is valid in some other context is still rejected here.
Issuers are registered per environment, so a development issuer cannot mint tokens for production. RS256 is the only algorithm accepted.
Related terms
- Token exchange — Trading a token issued by one system for a scoped token issued by another, so an application can act with narrowed authority.
- JWKS — A JSON document publishing the public keys a party uses to sign tokens, so verifiers can validate signatures without shared secrets.
- Multi-tenancy — One deployment serving many customers, with each customer’s data isolated from the others.
See it working rather than described.
The product demo runs one agent across three systems and stops at the approval gate.