/programs/{program_id}/jwksAdd JWKS URL
Adds a JWKS URL to the specified program for verifying JWTs used as the authentication mechanism.
The URL must be a valid HTTPS URL that returns a JSON Web Key Set.
The provider_name field allows you to specify which authentication provider you're using (e.g., Clerk, Auth0, AWS Cognito).
The framework_id scopes the JWKS URL to specific frameworks; if not specified, it applies to all frameworks.
The role_names scopes the URL to specific roles; if not specified, default roles are used (authenticator, authenticated, anonymous).
The jwt_audience specifies which aud values are accepted in JWTs.
Quick start
curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/jwks" \
-X POST \
-H "Authorization: Bearer $OPTITECH_API_KEY"import { createOptiTechClient, raw } from '@optitech/sdk';
const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY });
const { data } = await raw.addProjectJwks({
client: optitech.client,
path: {
program_id: process.env.PROGRAM_ID
}
});Parameters
program_idThe OptiTech program ID
Request body
2 required Required: jwks_url, provider_name.
jwks_urlThe URL that lists the JWKS
provider_nameThe name of the authentication provider (e.g., Clerk, Stytch, Auth0)
framework_idFramework ID
jwt_audienceThe name of the required JWT Audience to be used
role_namesDEPRECATED. This field should only be used when using OptiTech RLS. The roles the JWKS should be mapped to. By default, the JWKS is mapped to the authenticator, authenticated and anonymous roles.
skip_role_creationDEPRECATED. This field should only be used when using OptiTech RLS. If true, the role creation will be skipped.
Response
201The JWKS URL was added to the program's authentication connections
Errors
General error
This endpoint can return the standard OptiTech API error response.
Response fields
messageRequired. Human-readable error message.codeRequired. Machine-readable error code.request_idOptional. Request identifier for debugging. You can provide one with theX-Request-IDheader.
Retry guidance
If no response is returned, the request may still have reached the server. This is why retry safety depends on the method and status code.
Idempotent methods (GET, HEAD, OPTIONS) are generally safe to retry after a network error or timeout. Non-idempotent methods (POST, PATCH, DELETE, PUT) can change state, so avoid automatic retries unless your workflow can tolerate duplicate effects.
Responses with 423 Locked or 503 Service Unavailable are safe to retry. 423 Locked means the resource is temporarily locked, usually because another operation is in progress.